Magento 1.9.0.1 SECURITY ISSUE

Question

In the past few weeks, at least three customers have found that, at checkout, other people's details are showing up in their address book (totally unrelated people...no similarity in name, email or location).
It is almost as if the details have been held on the server cache. Has anyone had this issue before. Needless to say the customers have been very concerned (and one even threatening!). The whole of our Magento (all pages are SSL/https )

Answer 1

Content sharing can be caused by a number of things,

• Session sharing
  • Poor session validation
  • SID in URL (combined with the above)
• Caching
  • Full page cache modules
  • Reverse cache (Varnish/Nginx etc.)

Session sharing

If the user "becomes" another customer completely. Ie. They suddenly are logged in as another user. Then it is caused by session sharing.

Cause

This can be caused by a number of factors, usually weak session validation settings. Magento has four settings for session validation that IIRC are all disabled by default.

Resolution

Start by turning on remote address validation, this setting on its own works well - but there are some cases where the same public IP will be used by multiple users (ie. Carrier grade NAT - which is becoming increasingly more popular with the diminishing IPv4 resources).

Then continue to enable the other settings one by one if issues persist.

Caching

If your user only sees someone else's information on a single page, but when they click to another they no longer do - it's a cache issue.

Cause

This can be caused by the core block cache in Magento (if the cache keys have modified to remove the customer specific fields), by full page caching modules (even EE's FPC is guilty of this), by third party caching modules and last of all by reverse proxy caches.

Resolution

You'll need to identify the cause,

• If you have a third party caching module, remove it.
• If you are using Varnish/Nginx/Apache to cache, turn it off.
• If you are using EE FPC, turn it off.
• If you have modified the core, restore a clean copy.
• If you are using any other third party modules, disable one by one until the issue is gone.

There's a common misconception that HTTPS can/should not be cached, ignore it.

You can certainly cache HTTPS without issue, its identical to HTTP, just note the same common sense rules apply - don't cache a page with unique customer data on it.

Annoyingly, this is a very real side effect of deploying Varnish without being fully aware of the huge risks/dangers it poses when incorrectly configured (which in 99% of cases, it is).