1

Shortly after I (finally) managed to upgrade to Joomla 4 my development site was taken down by an attack. (I dont' know how exactly yet).

Is it worth my time to work out how this happened? How would I report this to the Joomla Team if it wasn't a simple misconfiguration that allowed the attack to take place?

1 Answer 1

2

Yes, it's also worth the time for your own benefit:

  • was it some server software vulnerability
  • was it a local computer vulnerability that was used to gain access to the (s)FTP credentials of your website
  • was it a 3rd party extension vulnerability
  • or was it an unknown Joomla 4.x vulnerability

You can use that info to make sure that this hack does not happen again.

Other things to consider

  • Did you obtain all software (Joomla + extension) from reliable sources? If it was a 3rd party vulnerability: please contact the developers so that they can take action regarding their extension
  • Did you consult your hosting company? If it was a server issue then other users on the same shared hosting server might have been compromised too.

To investigate the issue

  • Create a backup of the hacked site (for later analysis) and store at your local computer
  • Copy the server access and error log files asap to your local computer. Most servers use log rotate and only keep the log files for 7 days or so.

Joomla! Security Strike Team

In case you find an unknown vulnerability in Joomla 4.x, please contact the Joomla! Security Strike Team in private so that a security fix can be developed and released: https://developer.joomla.org/security.html

2
  • 1
    Thanks, after hours going through the access logs... It's not hacked. Joomla 4 has slowed up my server so that the requests were being served slowly. My load balancer thought that the server was down because requests took longer than 5s to return 200 http responses
    – Huw Evans
    Commented Sep 1, 2022 at 21:22
  • There's an issue with Joomla! 4.2.1 slow page load, see: forum.joomla.org/viewtopic.php?f=817&t=996159 It's caused by the "System - WebAuthn Passwordless Login" Plugin. You can solve it by disabling that plugin. And there's already a PR available: github.com/joomla/joomla-cms/pull/38664
    – pe7er
    Commented Sep 2, 2022 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.