Forum hack- what happened?

[epower53]

And can it happen again?

 

[eternal_noob]

A XSS vulnerability in XenForo.

Thread 'Forum Outage'

Yesterday at 11:39 PM

Hi guys, sorry that the FreeBSD Forums were offline for a couple of hours.

We were hit by an exploit against a slightly outdated XenForo version that we were still running.

The same exploit hit quite a number of XenForo installations today, including linux.org.

The FreeBSD Forums showed a defacement page for a couple of minutes before it was detected by the admins and then skillfully removed, after which the XenForo software was updated.

In the meantime the FreeBSD organization decided to take our DNS record offline, in case we were possibly spreading malware, which did not...

• DutchDaemon
• Replies: 0
• Forum: News and Announcements

• 
• 

Same happened to linux.org

https://www.linux.org/threads/whoops-a-xenforo-xss-vulnerability-bit-us.64521/

 

[mer]

I've been here for a while and this is the first time this has happened so "can it happen again"? Maybe but not in the exact same way.

 

[DutchDaemon]

You are only as good as the latest software you're running and the ability to keep up with those. We had a failure in keeping up with XF and that will not happen again. This was the first security event in the 18 years that these forums have been running, and it just goes to show that there is no reason to become complacent.

 

[Alain De Vos]

Current,
script src="/js/xf/preamble.min.js?_v=6b10b28c"></script>
<script src="/js/vendor/vendor-compiled.js?_v=6b10b28c" defer></script>
<script src="/js/xf/core-compiled.js?_v=6b10b28c" defer></script

 

[epower53]

Kudos to the team for taking the extra step and removing DNS records as a preventive measure until the scope of the problem was understood. I love that forum management are setting the example for good net citizenship.

 

[astyle]

Pheeeewww... back. Here's a screenshot I managed to take during that time.

Makes me wonder, did everyone else see that same defacing of the Forums, or did anyone see/get a different image?

 

[Alain De Vos]

Yes the same, I clicked on the link & there i could enter my email & password
I asked google ai about xenforo, it told me : freebsd-os, mariadb , nginx , php&zend.