Jetpack reporting BPS vulnerability

[Scott Mortimer]

For a short while now, Jetpack Protect in my WordPress sites has been marking BPS as having a security vulnerability:

The installed version of BulletProof Security Pro (17.6) has a known security vulnerability.

BulletProof Security <= 7.2 – Unauthenticated Sensitive Data Disclosure via Security Log

It then links to this: https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/

Is this valid, and if so, when can we expect it to be patched and an update released?

Thanks for any updates to the issue.

[AITpro Admin]

The security vulnerability that was reported to me claimed that the BPS Security Log text file here > /wp-content/bps-backup/logs/http_error_log.txt > could be viewed using a Browser, which could be true if you have NGINX setup as a reverse proxy in front of Apache.

Check your website using your full domain URL and add this path > /wp-content/bps-backup/logs/http_error_log.txt in the URL. You should see a 403 Forbidden error. If you do not see a 403 Forbidden error and you do see your BPS Security Log text file displayed to you in the Browser then you can turn off BPS Security Logging if you are concerned about someone viewing your BPS Security Log text file from a Browser. I highly recommend that you do not turn off Security Logging for BPS Pro (it is fine to do that for BPS free) and instead turn on the GDPR option setting on the Setup Wizard Options page.

Note: NGINX isn’t able to process Apache .htaccess files. All other web server types do process .htaccess files.

[Scott Mortimer]

Thanks for the response.

However, I use Apache and I can see the error log text at <mydomain>/wp-content/bps-backup/logs/http_error_log.txt

I have recently placed my domains behind Cloudflare due to my sites being overwhelmed by bot traffic.

Is there something I can do besides simply turning off threat info that I find useful?

[AITpro Admin]

Check the BPS System Info page and post this info about your server:

Server Type: Apache
Operating System: Linux
WP Filesystem API Method: direct
Server API: litespeed CGI Host Server Type
Apache Modules|Directives|Backward Compatibility(Yes|No)|IfModule(Yes|No):
403: mod_access_compat is Loaded|Order, Allow, Deny directives are supported|IfModule: Yes
403: mod_authz_core is Loaded|Order, Allow, Deny directives are supported|BC: Yes|IfModule: Yes
403: mod_authz_host is Loaded|Order, Allow, Deny directives are supported|BC: Yes|IfModule: Yes
200: mod_rewrite Module is Loaded|IfModule: Yes
403: mod_security2 Module is Loaded|Enabled|IfModule: Yes

[Scott Mortimer]

Server Type: Apache/2.4.66 (Ubuntu)
Operating System: Linux
WP Filesystem API Method: direct
Server API: fpm-fcgi CGI Host Server Type
Apache Modules|Directives|Backward Compatibility(Yes|No)|IfModule(Yes|No):
200: mod_access_compat is not Loaded|IfModule: Yes
200: mod_authz_core is not Loaded|IfModule: Yes
200: mod_authz_host is not Loaded|IfModule: Yes
200: mod_rewrite Module is Loaded|IfModule: Yes
200: mod_security Module is not Loaded|Enabled|IfModule: Yes

[AITpro Admin]

You don’t have these Apache modules loaded, which is odd:  mod_access_compat, mod_authz_core and mod_authz_host. Do you have your own VPS server? Honestly there is nothing in the BPS Security Log that exposes anything important. You can turn on the GDPR Compliance option setting on the Setup Wizard Options page if you are worried about GDPR compliance (hides visitor IP addresses).

Apache modules are added/loaded in a servers httpd.conf file if you had admin permissions to your server.

LoadModule access_compat_module modules/mod_access_compat.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule authz_host_module modules/mod_authz_host.so

[AITpro Admin]

People have been posting their BPS Security Log entries on this forum site and WordPress.org for years to get help. The only thing that I can think of that you would not want to display is a visitor’s IP address if you are worried about GDPR compliance.

[Scott Mortimer]

OK, thanks.

Hopefully something can be worked out with all involved to get the vuln downgraded so everyone running Jetpack Protect doesn’t have an eye-catching “Threat Found!” pinned to the top of their Admin Dashboard.

[AITpro Admin]

Yeah the “security vulnerability” stuff with WP is annoying. Dealt with it for years and a couple of the security vulnerabilities over the last 15+ years that were reported to me were legit. The rest were ridiculous claims. The guy who reported this to WP is trying to make a name for himself and WP handles anything that is labeled as a security vulnerability the same. So instead of pointing out the obvious to WP and explaining why this is not actually a security vulnerability, I decided to close the BPS free plugin. I may actually take BPS Pro off the market at the end of this year, but will continue to support BPS Pro for existing customers. Kind of tired of the whole WP experience. It was fun for many years, but there were lots of irritating headaches with the WP bureaucracy along the way.

[Scott Mortimer]

Yeah, I looked up the guy and saw on his LinkedIn page that he is definitely trying to make a name for himself.

I am sorry about all the troubles and I really hope you don’t discontinue work on BPS Pro, but I understand the reasoning. I have been using it for many years and have only good things to say about it.

Keep up the great work.

Scott

 

[AITpro Admin]

Yeah BPS Pro has been dependable and reliable for over a decade on all of my sites and other people’s sites. I still regularly keep an eye on security threats going on in the world. BPS Pro is completed in my opinion, but if any new security threats pop up or new Dev work is needed in BPS Pro for changes in PHP, Apache, etc. then I will do that Dev work and will release a BPS Pro update.

Yep, his LinkedIn page and GitHub repository tell the full story. He’s using AI to do the security forensic work, which is very obvious by the technical wording on GitHub. Nothing wrong with that of course, but he is not crediting AI for doing the heavy lifting. AI is amazing, but it still does not have the capability of sounding like a human.

[Author]

Posts