SUPEE-5994 Patch Bundle Admin Path Disclosure - Fix Not Working?

Question

I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly.

1. Compilation is off and cleared, caches flushed, etc.
2. Admin is on [https] devhost.local/index.php/SECRETSTRING
3. Accessing [http] devhost.local/index.php/MODULENAME/adminhtml_rule presents a login form on [https] devhost.local/index.php/MODULENAME/adminhtml_rule?SID=STRING

Am I misunderstanding either what the patch is meant to solve, is it an issue to pass to the developer of the affected modules or have I missed out something?

Answer 1

Aha! Looking through other questions with the 'security' tag, I found How did they find my custom admin URL? in which the responder, Steve Robbins, says:

Modules that incorrectly create admin controllers. Visiting a known, improper, admin frontname will redirect to the login screen. For instance, hitting example.com/mymodule_admin/foo/bar. A "safe" admin controller will extend on top of your customadmin frontname, like example.com/customadmin/mymodule/foo_bar.

So, it looks like the controllers of the affected modules are the cause of the login form being presented and the full admin URL being revealed in the "Forgot your password?" link.

I'm going to review all of my extensions now, see if I can fix them myself quickly and notify the third-party developers so that they can push updates to other affected users. Once done, I'll change my admin URL again, and implement IP based restrictions to tighten things up a little.