2

I'm working on a website for client that is setup on Joomla. While testing various forms, I noticed the following message on white background after submitting any of them with various data:

A sequence has been discovered that could indicate a hacker attack. Your request can not be processed.

The same data works most of the time and then randomly can not be successful, so I don't think it's about data. The form submission fails and the websiteis losing potential clients.

Possible culprits:

  • ModSecurity - it was enabled before. I disabled it in cPanel for one day and tested forms - the error still occured. Nothing interesting in source code.
  • smarthost.pl hosting - they claim it's not on their side.
  • Joomla - I looked for this error in the source code with no results.
  • BreezingForms extension used for most forms - no sign of the word "hacker" in the source code either.

So I'm stumped and confused as to what the origin of this might be. Especially that Googling the full error also yields nothing except seemingly random websites from various countries, which I guess eliminates the hosting. I think they're all on Joomla but not sure.

Any clue what this might be? Did anyone encounter such a message?

Improve this question
1
  • All examples of this error message I’ve found were in a div with the ID system-message-container. Google tells me this is a Joomla-specific container to display error messages. If there’s a log for those messages, maybe it contains further information like a backtrace. Otherwise, look specifically for code which generates messages through the Joomla error mechanism. Or patch the mechanism to trace all generated messages.
    – Ja1024
    Commented Jul 16 at 23:57

1 Answer 1

Reset to default
1

The error message you provided is used in the Joomla Securitycheck extension. In version 4.1, source available here, the error message is defined in com_securitycheck/admin/language/en-GB/en-GB.com_securitycheck.ini line 128:

COM_SECURITYCHECK_400_ERROR="A sequence has been discovered that could indicate a hacker attack. Your request can not be processed."

The error message appears to be triggered in file com_securitycheck/plugins/system/securitycheck/src/Extension/Securitycheck.php lines 240 and 690. Lines around 240 are labelled as XSS Prevention - the code appears to check for suspicious strings via regex. Line 690 is more generic, triggering when user input is deemed to be suspicious. The checks appear to primarily revolve around the aforementioned XSS detection, plus SQL injection detection, in both request body and HTTP headers.

Improve this answer
1
  • 1
    Thank you, this helped a lot. I now found the logs of this extension and it seems to block requests for "Line comments" and "Integers (0x format)" reasons, not only the forms, but also some random pages. This is so weird, it seems extremely unstable. I think I'll just disable it, as ModSecurity should cover most attacks anyways. –
    – Destroy666
    Commented Jul 17 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.