Spam url_alias entries being created - how do I stop them?

Question

I'm using Drupal 6 and having trouble with url_alias spam.

Somehow spam entries are showing up in the url_alias table as aliases for valid content.

I thought an administrator or valid user would have to create these. I don't understand how they're appearing for content that I created.

I appeared to have stopped spam registrations using a combination of Mollom, honey pot and spamicide. I can't figure out how the url_aliases are appearing.

Can anyone give me a good place to try to start figuring this out?

Thanks, Joe

Answer 1

Who have access to Administer ➔ Site building ➔ URL aliases depends on how you've set access to the permissions administer url aliases and create url aliases under Administer ➔ User management ➔ Permissions. If you've granted access to the Anonymous user role, everybody can do it. If you've granted access to Authenticated user role, a rogue authenticated user can do it.

First, check out these permissions and make sure they are safe. Leave them unchecked for all roles. Then, only the super admin (user #1) can create aliases using the GUI.

If these setting are secure, and you still get unwanted url_alias entries created, then some outsider has gained direct access to your database. That's bad.

Finding the cause of database intrusion is not easy. Possible attack vectors are: A bad module that permits SQL injection, some means outside of Drupal (an inscure phpMyAdmin is the most common cause), or (in particular if you're on shared hosting) a host misconfiguration.

However, without having direct access to your site's and its log for forensics, it is impossible to know how an outsider has gotten into your database (if that is indeed the cause).