0

I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it.

to prevent this I can disable the magento_version module from command line but not sure disabling this module will impact on any other feature. In code I noticed they are only using controller to display the info. But i am not sure it's used elsewhere or not. Also, possible magento use it for API or something or for composer based upgrades?

Will there be any negative impact if we disable? Should i hide my version number publicly? Is it good to hide it?

Any help would be appreciated.

2

for hackers version detection is not from that url, they have files hashes to scan your shop to get magento version with 95% accuracy. and so the same way they scan for any vulnerabilities.

what you need to do is to monitor your access log for any suspicious access pattern.

also there are nginx configs that block any basics, and if you add some secutiry monitoring tool like for example OSSEC(pretty noisy) with EKL stack, you can adjust your servers rules in real time.

so the answer - dont hide version - change it in module or using html/url rewrite. this will keep "kiddies" a bit confused.

1

This was news to me

https://www.atwix.com/magento-2/hide-version/

php bin/magento module:disable Magento_Version

I can't think of anything negative

  • Yes, I saw that but is there any security risk? Will there be any negative impact? Site is EE M2 and hosted on cloud. I don't want to jump into frog pool. Could you please help and suggest? – Jackson Wyss Jul 18 at 18:37
  • No negative I can think of – Dominic Xigen Jul 18 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.