Security
mySites.guru says Joomla .htaccess hardening has limits
mySites.guru has warned that Joomla administrators may overestimate the protection provided by hardened .htaccess files, since many extension vulnerabilities are reached through the normal index.php entry point.
The research, published by mySites.guru, discusses recent third-party extension attacks and cites two vulnerabilities in products from JoomShaper: an unauthenticated file write in Helix3 and an unauthenticated menu write that could lead to stored cross-site scripting in Helix Ultimate.
The article does not provide affected or fixed version numbers, CVE identifiers, a formal severity rating, or a statement confirming active exploitation for either issue. It also does not present a new Joomla core vulnerability. Instead, it explains why request-level rules cannot determine whether code reached through the front controller will safely process a request.
Administrators should not treat .htaccess hardening as a replacement for keeping Joomla extensions updated. Site owners using the cited JoomShaper products should check the vendor’s current release information and apply available security updates, while also recognising that server rules may affect legitimate callbacks and recovery tools.
Originally reported by mySites.guru.