As some of you may know, a Cloudflare vulnerability has been released yesterday. From what I understood, a lot of websites have been affected because they hosted JS libraries on their CDNs.
- Where it started: https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
- Cloudflare blog post: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
- List of affected websites: https://github.com/pirate/sites-using-cloudflare
From this last link you have a "What should I do ?" section :
Check your password managers and change all your passwords, especially those on these affected sites. Rotate API keys & secrets, and confirm you have 2-FA set up for important accounts. This might sound like fear-mongering, but the scope of this leak is truly massive, and due to the fact that all cloudflare proxy customers were vulnerable to having data leaked, it's better to be safe than sorry.
Theoretically sites not in this list can also be affected (because an affected site could have made an API request to a non-affected one), you should probably change all your important passwords.
Submit PR's to add domains that you know are using cloudflare
Now, regarding Magento specifically:
- should we change all the Magento passwords ?
- admin passwords ?
- frontend passwords too ?
- email the entire customer database and change the hashes so they use the forgot password feature ?