• Resolved JustBruno

    (@justbruno)


    Hi,

    The other day we tried to create a new page (an additonal content type) and was redirected to safe-load.gotmls.net with a code: gotmls 9351730: FW_Traversal

    I googled the code without any luck and am thinking it’s a GOTMLS code that isn’t very common. Can you help?

    Thanks!!

    (BTW: I appreciate your good work every day!!!)

Viewing 8 replies - 1 through 8 (of 8 total)
  • Plugin Author Eli

    (@scheeeli)

    This is the Directory Transversal protection in the Firewall Options. This feature prevents the submission of any variable that contains ../ in the value, which protects you against the potential exploitation of some themes and plugins that might otherwise allow a hacker to read or write to an arbitrary file on your server.

    You can look into the contents of the form that you posted on your site that got redirected and see if you can spot the usage of ../ in one of that field values, or you can just turn this feature off on the Firewall Options page in your wp-admin (but understand that you may be leaving your site open to a directory transversal attack if you have any vulnerable plugins or theme feature that could be exploitable if you turn off this option).

    Feel free to write back with more detail if figure out why this form was getting blocked or if you need more help to figure it out.

    Thread Starter JustBruno

    (@justbruno)

    No, there wasn’t ../ in any of the fields.

    Plugin Author Eli

    (@scheeeli)

    Maybe it was something like /etc/ or maybe it was a hidden field.

    If this is a consistent and repeatable occurrence then maybe you could provide me with HTML of the completed form that is getting blocked/redirected so that I can check it against the current firewall pattern to see what it causing it to be flagged as a directory transversal?

    You can email me with any content examples if you don’t want it to be posted on this public forum:
    eli AT gotmls DOT net

    Thread Starter JustBruno

    (@justbruno)

    Will do first thing Monday. Thanks!!!

    Plugin Author Eli

    (@scheeeli)

    I have not seen any emails from you yet and I look forward to helping you find the solution to this issue. Please let me know if you figure it out or if you need more help.

    I have a similar issue…

    I made a video (hopefully helps) I am not an expert on this… I will send to you in private.

    But every time I try to save something in that page, takes me away, but doesn’t tell me what to do about it or something…

    If you need any specific file let me know… thanks

    (note: my website still under construction)

    • This reply was modified 4 years, 9 months ago by ikihinojosa.
    • This reply was modified 4 years, 9 months ago by ikihinojosa.

    i have the same issue. it happens when i change the page template in Page Attributes.
    Any help please?

    Plugin Author Eli

    (@scheeeli)

    As I have outlined above, this is caused by some field in your form that has an escaped path reference in it. It is likely different in every case and I can’t say what is causing it without seeing it.

    If you want my help identifying the precise threat then please follow these steps…

    When you are on the wp-admin page with the form that is being blocked, but before you submit the page, can you please right click on the page and choose Inspect. Then right click on the <HTML> tag at the top of the source code and choose “copy outerHTML” from the “copy” sub-menu. Then paste that into an email and send it directly to me so that I can debug your form and tell you what is causing this potential Directory Transversal attack.

    eli AT gotmls DOT net

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘FW_Traversal’ is closed to new replies.