Forum

Hi Hugo,

We are using a wordpress site and one of our theme has svg upload build in...
My understanding is that svg file shouldn't be loaded on a production public facing server as someone could upload an XML Bomb or an SVG with an XXE attack or even a lovely XSS attack...

Could you please tell me if the core feature of Hiawatha will block such attack with defaukt setup?
I am asking you also because I know you have many year of pentest behind you.

Thank you

I have no experience with the Wordpress SVG upload functionality, so I don't know how secure it is. So, I also don't know if Hiawatha's XSS prevention option will help. All I can do is to advice not to use Wordpress. It has a history of bad security and many exploits. If you still want to use it, despite all the warnings, the risk is all yours.

Hi Hugo,

Thank you for the reply, I really appreciate the input but wordpress is what people want at the moment.. so unless we spend a forture reinventing and new secure cms, I have no choice at the moment.

I am however willing to consider alternative... Could you please sugest and ready to use cms that can be use for e-commerce?

As took the decision to use font-awsome over svg.. as you said, wordpress has enough holes as it stand..

To secure it, we set read only persion to www except /upload and do all update via cli

It requires some programming to adjust it to your needs, but have you seen my CMS [www.banshee-php.org] yet?

I looked at it last year..i'll take another look:)