0

My website's checkout was hacked this 4th time. The hacker somehow modifies the following files:

  • lib/web/jquery.js
  • vendor/magento/framework/Interception/Interceptor.php
  • vendor/magento/framework/Message/Session.php

and adds some kind of encrypted scripts and code, which hides all the payment methods and shows a custom credit card payment option. I have tried multiple solutions:

  • changing passwords (FTP/ssh/db/admin),
  • making ssh access with a private key only,
  • changing admin URL, and website folder permissions. But still, he is able to hack again n again.

My hosting is on a managed server. I asked the hosting provider (since they have the root access) and they told me that it could be because of some kind of plugin (not sure).

What could be the possible solution? Please help. The upgrade to the latest magento is already in progress, but don't know whether it would be the solution.

Improve this question
5
  • 1
    What version are you using ? Did you applied the latest patches (which can be done faster than an upgrade) ? How many third party modules are you using ? Any custom dev/theme ? How fast does the hack come back after fixing the files ?
    – Cladiuss
    Aug 8 at 11:42
  • Magento version is 2.3.2. Which security patches should I apply directly? I am using some 3rd party modules, but majority of them are paid. The 1st hack was in Jan. Then Mar, and from last week its been 3 times already now. And same files are changed
    – Arsalan Ul Haq
    Aug 8 at 11:46
  • You have to check files and folder properly set for your projection. You have must check this
    – Amit Bera ♦
    Aug 8 at 12:25
  • Also use Web firewall like Cloudflare or surcuri
    – Amit Bera ♦
    Aug 8 at 12:26
  • Also screen code base using Anti virus software
    – Amit Bera ♦
    Aug 8 at 12:29

1 Answer 1

Reset to default
0

Do following steps to recover the website checkout.

Step 1: Identify all the affected files in the setup.

Step 2: Review the code of all third-party extensions to check for issues.

Step 3: Replace all affected files with Magento default files and ensure there is no malicious code in the third-party extensions.

Step 4: Update FTP or SFTP details, and also change Magento admin credentials.

Step 5: Scan the database for any injected malicious content.

Step 6: Adjust file and folder permissions according to the Magento guide.

You can refer to the guide provided below for more information: https://devdocs.magento.com/guides/v2.3/config-guide/prod/prod_file-sys-perms.html

Improve this answer
1
  • Step 1 - already provided. I have identified and mentioned the affected files in the Issue. Step 2 - How and what to check in third-party extensions? Step 3 - How? Since only vendor files can be replaced I guess, and extensions can be upgraded. Step 4: already done. Still hacked Step 5: How? Step 6: already did
    – Arsalan Ul Haq
    Aug 8 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.