3

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility.

While their tool is very helpful in scanning the site and asserting whether our site is vulnerable or not, they do not provide steps for fixing the issue.

Does anyone know what the vulnerability is and what immediate steps can be taken besides for disabling the module? To the best of my knowledge, Webgility has not released an updated module.

UPDATE

So, it turns out that as per Willem de Groot's post - webgility was made aware of the flaw and are apparently not taking it seriously.

The fix according to Willem is to restrict access to the webgility directory to recognized IP addresses.

Improve this question
4

2 Answers 2

Reset to default
1

We have released the patch of Webgility Store Module. Please refer our blog for complete details. https://www.webgility.com/blog/security-vulnerability-update/

Improve this answer
3
  • 2
    on your blog post you write that None of our customers’ stores or data have been breached. - that's a pretty bold statement to make - our customer's store was breached
    – Haim
    Commented Nov 22, 2018 at 16:05
  • Hello Haim, Please let us know which customer's store was breached so that we can contact him and update their module.
    – Brajkishor Shacywar
    Commented Nov 23, 2018 at 16:09
  • please release a downloadable plugin.
    – Kalvin Klien
    Commented Nov 27, 2018 at 18:25
0

That's what we're trying; IP restriction only allowing client's hosted Quickbooks to access that.

Just took over this project but so far many other issues with webgility. Longer term solution is ditching quickbooks and the need for webgility

Improve this answer
5
  • did you figure out which IP addresses they use to connect or is it the client IP address that connects to the store?
    – Kalvin Klien
    Commented Nov 19, 2018 at 4:34
  • Actually we tried to lock down to only the IP from Webgility desktop to magento and it did not work. Webgility would not connect. Need to get in touch with Webgility for a working solution. They provided a patch but client had not updated in some time so it changes 100's of lines of code. No bandwidth this week (Black Friday) to properly vet that.
    – JSMD
    Commented Nov 20, 2018 at 20:43
  • 1
    I will be testing a solution today, I just found a list of IP addresses that belong to Webgility. I'll post them here if you need.
    – Kalvin Klien
    Commented Nov 21, 2018 at 21:59
  • Any details would be super appreciated if works for you. Been hard to fit this in the schedule but also have a sense of dread...
    – JSMD
    Commented Nov 26, 2018 at 1:33
  • Apologies, here is contents of .htaccess: pastebin.com/FxyD9UGq This is untested yet - we have been concentrating on other things. If this doesnt work, try to tail -f on your access logs and see which IP addresses are hitting your website.
    – Kalvin Klien
    Commented Nov 27, 2018 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.