I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly.

  1. Compilation is off and cleared, caches flushed, etc.
  2. Admin is on [https] devhost.local/index.php/SECRETSTRING
  3. Accessing [http] devhost.local/index.php/MODULENAME/adminhtml_rule presents a login form on [https] devhost.local/index.php/MODULENAME/adminhtml_rule?SID=STRING

Am I misunderstanding either what the patch is meant to solve, is it an issue to pass to the developer of the affected modules or have I missed out something?


Aha! Looking through other questions with the 'security' tag, I found How did they find my custom admin URL? in which the responder, Steve Robbins, says:

Modules that incorrectly create admin controllers. Visiting a known, improper, admin frontname will redirect to the login screen. For instance, hitting example.com/mymodule_admin/foo/bar. A "safe" admin controller will extend on top of your customadmin frontname, like example.com/customadmin/mymodule/foo_bar.

So, it looks like the controllers of the affected modules are the cause of the login form being presented and the full admin URL being revealed in the "Forgot your password?" link.

I'm going to review all of my extensions now, see if I can fix them myself quickly and notify the third-party developers so that they can push updates to other affected users. Once done, I'll change my admin URL again, and implement IP based restrictions to tighten things up a little.

  • yes, the there described disclosure is not fixed yet. Another partially helpfull thing to do is removing the passwort forgot link from the login form. I assume a lot of admins dont need it anyway – Flyingmana May 17 '15 at 0:48
  • Did you manage to fix this? – Adarsh Khatri Oct 24 '16 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.