0

My website's checkout was hacked this 4th time. The hacker somehow modifies the following files:

  • lib/web/jquery.js
  • vendor/magento/framework/Interception/Interceptor.php
  • vendor/magento/framework/Message/Session.php

and adds some kind of encrypted scripts and code, which hides all the payment methods and shows a custom credit card payment option. I have tried multiple solutions:

  • changing passwords (FTP/ssh/db/admin),
  • making ssh access with a private key only,
  • changing admin URL, and website folder permissions. But still, he is able to hack again n again.

My hosting is on a managed server. I asked the hosting provider (since they have the root access) and they told me that it could be because of some kind of plugin (not sure).

What could be the possible solution? Please help. The upgrade to the latest magento is already in progress, but don't know whether it would be the solution.

5
  • 1
    What version are you using ? Did you applied the latest patches (which can be done faster than an upgrade) ? How many third party modules are you using ? Any custom dev/theme ? How fast does the hack come back after fixing the files ?
    – Cladiuss
    Commented Aug 8, 2023 at 11:42
  • Magento version is 2.3.2. Which security patches should I apply directly? I am using some 3rd party modules, but majority of them are paid. The 1st hack was in Jan. Then Mar, and from last week its been 3 times already now. And same files are changed Commented Aug 8, 2023 at 11:46
  • You have to check files and folder properly set for your projection. You have must check this
    – Amit Bera
    Commented Aug 8, 2023 at 12:25
  • Also use Web firewall like Cloudflare or surcuri
    – Amit Bera
    Commented Aug 8, 2023 at 12:26
  • Also screen code base using Anti virus software
    – Amit Bera
    Commented Aug 8, 2023 at 12:29

1 Answer 1

0

Do following steps to recover the website checkout.

Step 1: Identify all the affected files in the setup.

Step 2: Review the code of all third-party extensions to check for issues.

Step 3: Replace all affected files with Magento default files and ensure there is no malicious code in the third-party extensions.

Step 4: Update FTP or SFTP details, and also change Magento admin credentials.

Step 5: Scan the database for any injected malicious content.

Step 6: Adjust file and folder permissions according to the Magento guide.

You can refer to the guide provided below for more information: https://devdocs.magento.com/guides/v2.3/config-guide/prod/prod_file-sys-perms.html

1
  • Step 1 - already provided. I have identified and mentioned the affected files in the Issue. Step 2 - How and what to check in third-party extensions? Step 3 - How? Since only vendor files can be replaced I guess, and extensions can be upgraded. Step 4: already done. Still hacked Step 5: How? Step 6: already did Commented Aug 8, 2023 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.