7

Today we learned that Magento has a new vulnerability. They call it NEW ZEND FRAMEWORK 1 SECURITY VULNERABILITY.

It's described as follow here:

To protect your site from this vulnerability, you should immediately check your mail sending settings. Go to the system settings used to control the “Reply to” address for emails sent from your Magento store:

Magento 1: System-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path

Magento 2: Stores-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path

If “Set Return-Path” is set to “Yes,” and your server uses Sendmail, then your store is vulnerable to this exploit. Enterprise Cloud Edition customers do not need to worry about this issue. We’ve already checked your configuration and you are not at risk.

Currently I have settings for Set Return-Path as Specified in my EE.

Magento suggests

Enterprise Cloud Edition customers do not need to worry about this issue

and also

set it to NO

I am a little confused what to do till the patch arrives.

Am I vulnerable?

|improve this question
5

Enterprise Edition != Enterprise Cloud Edition

I assume Cloud Edition customers are either not affected by the exploit because they do not use sendmail or Magento changed the configuration for them:

We’ve already checked your configuration and you are not at risk.

The following holds true for CE 1.x as well as EE 1.x

If you use sendmail, do as suggested by Magento and configure the return path setting to "No". If you don't know if you use sendmail for emails, you probably use it, as it is the default.

Is "specified" secure?

I had a look at the core to see where this setting is used. The relevant code is in Mage_Core_Email_Template:

$setReturnPath = Mage::getStoreConfig(self::XML_PATH_SENDING_SET_RETURN_PATH);
switch ($setReturnPath) {
    case 1:
        $returnPathEmail = $this->getSenderEmail();
        break;
    case 2:
        $returnPathEmail = Mage::getStoreConfig(self::XML_PATH_SENDING_RETURN_PATH_EMAIL);
        break;
    default:
        $returnPathEmail = null;
        break;
}

(1) is "yes", (2) is "specified", and 0 (default) is "no"

The only setting where user input can be used, is "yes". So if you trust your shop admins with access to the system configuration, "specified" is okay too: it takes the address from a constant configured value.

There is one other occurence of the configuration, in Mage_Newsletter_Model_Template:

if (Mage::getStoreConfigFlag(Mage_Core_Model_Email_Template::XML_PATH_SENDING_SET_RETURN_PATH)) {
    $this->getMail()->setReturnPath($this->getTemplateSenderEmail());
}

Here, "specified" is treated the same way as "yes", but the newsletter sender email does not come from untrusted user input, so the same as above applies.

Magento 2.x

Currently, the "return path" setting is not used anywhere in Magento 2.

Here is a bug report: https://github.com/magento/magento2/issues/6146

Luckily, the bug has not been fixed yet, so Magento 2 without extensions is not affected by the exploit.

|improve this answer
  • I can't comment because I just joined. I have the same issue but I'm on CE. The dropdown has 3 options: Yes, No, and Specified. Is Specified safe or should it be changed to No? – Matt Dyer Jan 16 '17 at 16:15
  • When "No" - this completely shuts down delivery of email by the store. Emails are sent, but regarded as spam on the side of person who receives the email. I'll be testing specified right now to see what happens. – Kalvin Klien Jan 16 '17 at 18:23
  • From what I'm reading this header is just used for "Bounced" emails. Some servers use it, some dont. Its just weird that it's some kind of requirement for spam filtering. – Kalvin Klien Jan 16 '17 at 18:46
  • yeah looks like Specifying the email address works. There are no bounced emails when you hardcode it to one address. Thanks @fschmengler. I have not tested if this nullifies the threat, but from what Fabian posted here it looks like there hardcoding it like this will solve the issue temporarily. – Kalvin Klien Jan 16 '17 at 21:57
  • 1
    ^^^ i found this "The Sender header is used to identify in the message who submitted it. This is usually the same as the From header, which is who the message is from. However, it can differ in some cases where a mail agent is sending messages on behalf of someone else." stackoverflow.com/questions/4367358/… I set mine to bounce@domain.com...so far no bounces or issues when looking through the mail logs – Kalvin Klien Jan 17 '17 at 0:13
1

Yes, it is safe.

I've received this message from Magento Support

I've been informed that using "Specified" from a security standpoint is safe, however if the email address is not correctly set up on the server it might end up as spam.

You can go ahead and use it as long as you've correctly setup the email address used.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.