Securing sessions and preventing hijacking

SMF versions prior to 1.1.2 were vulnerable to session fixation attacks (CVE-2007-2546) where attackers could hijack user sessions by setting the PHPSESSID parameter. To mitigate this:

# Modify php.ini session settings
session.use_only_cookies = 1
session.use_trans_sid = 0
session.cookie_httponly = 1
session.cookie_secure = 1  # Enable only if using HTTPS
session.use_strict_mode = 1

For SMF-specific session hardening:

# In Settings.php
$disableSessionCheck = false;
$forceSSL = true;  # Requires HTTPS

Verify your session configuration:

php -i | grep -E 'session.use_only_cookies|session.use_trans_sid|session.cookie_httponly|session.cookie_secure|session.use_strict_mode'

Preventing XSS attacks

SMF versions up to 1.1.4 were vulnerable to cross-site scripting (CVE-2008-0284) through Itemid and topic parameters. Follow these steps to secure against XSS:

# Update SMF to latest version
cd /path/to/smf
composer update

Implement Content Security Policy headers in your web server config:

# LiteSpeed .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"

Enable SMF's built-in XSS protection:

# In Settings.php
$modSettings['enableSpamProtection'] = true;
$modSettings['spamProtectionLevel'] = 'high';

Securing file permissions and preventing local file inclusion

Local file inclusion vulnerabilities (CVE-2013-7466) in SMF 2.0.4 could lead to remote code execution through install.php. Secure your installation:

# Remove installation files
rm /path/to/smf/install.php
rm -rf /path/to/smf/install*

Set proper file permissions:

# Recursively set permissions
find /path/to/smf -type d -exec chmod 755 {} \;
find /path/to/smf -type f -exec chmod 644 {} \;

# Protect sensitive files
chmod 440 /path/to/smf/Settings.php
chmod 440 /path/to/smf/Settings_bak.php

Implement PHP open_basedir restrictions:

# In php.ini
open_basedir = /path/to/smf/:/tmp/

Regularly audit your installation:

# Find world-writable files
find /path/to/smf -perm -o+w -ls

Additional security measures

To further harden your SMF installation:

  1. Enable SMF's built-in security features: 
    # In Settings.php
$modSettings['enableSecurityQuestions'] = true;
$modSettings['secureCookies'] = true;
$modSettings['forceHTTPS'] = true;
  2. Implement brute force protection: 
    # In Settings.php
$modSettings['failed_login_threshold'] = 5;
$modSettings['failed_login_time'] = 3600;
  3. Regularly update SMF and all installed mods: 
    cd /path/to/smf
composer update
php upgrade.php
  4. Monitor SMF logs for suspicious activity: 
    tail -f /path/to/smf/SMF_Logs/*.log