28

Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are the possible attacks that could affect and unpatched shop? What 's the worst that could happen?

Update: I just wanted to add the email magento sent today to complete the post. Magento Email Update

  • 1
    I am sure there will be a wrap-up these days. However, if you checked it already and want to have a discussion, go ahead! Share your thoughts and findings! – mam08ixo Aug 4 '15 at 15:47
  • 2
    The patch itself, no. The full install for 1.9.2.1 would have to be examined for those changes, at this point it seems to only address 4 security issues – Fiasco Labs Aug 4 '15 at 18:43
  • 2
    You will have to do a full upgrade, or backport 1.9.2.0 => CMS Block and Widget caching in magento-1921/app/code/core/Mage/Cms/Block/Block.php and magento-1921/app/code/core/Mage/Cms/Block/Widget/Block.php – Fiasco Labs Aug 4 '15 at 18:54
  • 2
    merch.docs.magento.com/ce/user_guide/… - I've just wondered when the next patch will come after there was so much focus on headers the last days. And there it is! – hakre Aug 4 '15 at 20:37
  • 2
    @hakre - I'd read the patch contents before including headers, unless those headers are actually in the API. The full download has some patches in the http controller and javascript cookie template, but the 6482 patch doesn't. – Fiasco Labs Aug 4 '15 at 22:35
13

The actual security patch (SUPEE-6482) only affects the two following files and is an API patch.

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php
app/code/core/Mage/Catalog/Model/Product/Api/V2.php

The full 1.9.2.1 install is a different matter altogether. I would diff source code between 1.9.2.0 and 1.9.2.1 to figure out the other two items that were patched.

Release notes are for the full installer, you have to check the patch to see if it actually includes all the items noted in the release notes.

Implications of running an unpatched server:

  1. Cross-site Scripting Using Unvalidated Headers => Cache Poisoning
  2. Autoloaded File Inclusion in Magento SOAP API => Remote code autoload
  3. XSS in Gift Registry Search => Cookie theft and user impersonation
  4. SSRF Vulnerability in WSDL File => Internal server info leak and remote file inclusion

NOTE: Files patched in the full install archive that are not patched with the patch, hmm?

diff -r magento-1920/app/code/core/Mage/Core/Controller/Request/Http.php magento-1921/app/code/core/Mage/Core/Controller/Request/Http.php
300a301
>         $host = $_SERVER['HTTP_HOST'];
302,303c303,304
<             $host = explode(':', $_SERVER['HTTP_HOST']);
<             return $host[0];
---
>             $hostParts = explode(':', $_SERVER['HTTP_HOST']);
>             $host =  $hostParts[0];
305c306,313
<         return $_SERVER['HTTP_HOST'];
---
> 
>         if (strpos($host, ',') !== false || strpos($host, ';') !== false) {
>             $response = new Zend_Controller_Response_Http();
>             $response->setHttpResponseCode(400)->sendHeaders();
>             exit();
>         }
> 
>         return $host;

diff -r magento-1920/app/design/frontend/base/default/template/page/js/cookie.phtml magento-1921/app/design/frontend/base/default/template/page/js/cookie.phtml
37,38c37,38
< Mage.Cookies.path     = '<?php echo $this->getPath()?>';
< Mage.Cookies.domain   = '<?php echo $this->getDomain()?>';
---
> Mage.Cookies.path     = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getPath()) ?>';
> Mage.Cookies.domain   = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getDomain()) ?>';
  • 5
    I think the missing files fix the most critical "Cross-site Scripting Using Unvalidated Headers" issue. The "XSS in Gift Registry Seaerch" issue seems to be mistakenly added to the patch documentation for the CE version, as the Gift Registry is an EE-only feature. – Aad Mathijssen Aug 5 '15 at 6:41
  • 1
    Yep, I figured that it was important enough to apply the missing changes to my CE installation anyway and not wait for Magento to figure it out and send us a V2 patch when they get around to it. Cache poisoning and unfiltered user input used in cookie components seems like a biggie. – Fiasco Labs Aug 5 '15 at 6:58
  • 1
    Magento has updated the documentation: both the "Cross-site Scripting Using Unvalidated Headers" and "XSS in Gift Registry Search" issues are marked as "For Magento Enterprise Edition Only". But in the meantime, Magento CE 1.9.2.1 does contain fixes for the "Cross-site Scripting Using Unvalidated Headers" issue, or at least a part of it. – Aad Mathijssen Aug 5 '15 at 14:11
  • 1
    Heh, the CE short-change in action. CE doesn't have the Wishlist, but definitely needs the "Unvalidated Headers" issue to go away via patch, not documentation change. Oh, well... more of what we've come to expect. – Fiasco Labs Aug 5 '15 at 15:01
  • 3
    For the record - according to our tests - Cross-site Scripting Using Unvalidated Headers is NOT a CE vulnerability. If anyone can provide a POC that there is a CE vulnerability, please go to magento.com/security and report it. – benmarks Aug 5 '15 at 20:01
9

I hade a look at the changes in detail and which side effects are to expect.

In the version for EE 1.13.1.0 the following files changed:

2015-08-05 07:14:25 UTC | SUPEE-6482_EE_1.13.1.0 | EE_1.13.1.0 | v2 | 7e38036f94f250514fcc11d066a43c9bdb6a3723 | Tue Jul 28 14:29:35 2015 +0300 | v1.13.1.0..HEAD
patching file app/code/core/Enterprise/PageCache/Model/Processor.php
patching file app/code/core/Mage/Api/Model/Server/Adapter/Soap.php
patching file app/code/core/Mage/Catalog/Model/Product/Api/V2.php
patching file app/code/core/Mage/Core/Controller/Request/Http.php
Hunk #1 succeeded at 294 (offset 7 lines).
patching file app/design/frontend/base/default/template/page/js/cookie.phtml
patching file app/design/frontend/enterprise/default/template/giftregistry/search/form.phtml
  • In Adapter/Soap.php, urlencoding is added to authentication data. This should have no negative side effect. It ensure, that the resulting wsdlUrl is valid. Without this change, one could influence the URL
  • Product/Api/V2.php: Here are some checks if passed data is an object. This should not happen under normal circumstances.
  • in Request/Http.php and PageCache/Model/Processor.php a check is added when getting the HTTP HOST. This seems to cover the header injections mentioned. The check only applies if there is a ; or , in the HTTP host, so this should be uncritical in real life systems / have no negative side effect.
  • in the cookie.phtml escaping is added. So this has to be forward ported to your theme if you overwrite that file
  • similar for giftregistry/search/form.phtml

To sum it up, I would say that applying the patch should not have any negative side effects. Remember to forward port the changes to your .phtml files.

  • 1
    Thanks for the confirmation, the header injection and cookie component escaping are easy to backport to CE. – Fiasco Labs Aug 5 '15 at 18:56
  • 1
    No need to port. There are patch versions also for CE in the download area. – Alex Aug 6 '15 at 20:36
5

Weird thing is that EE patch contains modifications on following files:

app/code/core/Mage/Core/Controller/Request/Http.php
app/design/frontend/base/default/template/page/js/cookie.phtml

When the CE one doesn't, for an equivalent version.

I presume there is something missing on that SUPEE-6482 CE version, and a V2 could be released soon.

  • I thought the same thing! – rob3000 Aug 5 '15 at 2:34
  • 2
    Yes, you noticed right. That's what I got by diffing the 1.9.2.0 and 1.9.2.1 installation archives. I have a fully patched CE installation due to this, I went ahead and manually patched the two files mentioned. The js cookie file needs to be patched in your custom template as well if you have that file in it. They probably skipped the request controller as a patch for it would have to patch a previously patched file and we got no CE love going on. – Fiasco Labs Aug 5 '15 at 5:54
  • 1
    One more reason to "wait" some days before to deploy on production environment (and use these days to do better checks before going live). Today, one more update notification in Magento Backend (just the notice about the 2 instead of 4 security vulnerability ). Anyway, I'll wait until monday for going live, at least. – DarkCowboy Aug 6 '15 at 9:24
  • 1
    Magento has updated their release note: merch.docs.magento.com/ce/user_guide/… Some patches are effectively EE only. But I still don't get why those 2 files, core based, are not concerned in CE patch, as they are integrated in the CE 1.9.2.1... – Antoine Kociuba Aug 7 '15 at 10:39
4

Magento release patch SUPEE-6482 for fix for below issue in edition CE & EE

For Magento Community Edition:

  • Autoloaded File Inclusion in Magento SOAP API
  • SSRF Vulnerability in WSDL File

For Magento Enterprise Edition

  • Autoloaded File Inclusion in Magento SOAP API
  • SSRF Vulnerability in WSDL File
  • Cross-site Scripting Using Unvalidated Headers

XSS in Gift Registry Search

Doing change at class

  • Mage_Api_Model_Server_Adapter_Soap

  • Mage_Catalog_Model_Product_Api_V2

Changes at Mage_Api_Model_Server_Adapter_Soap

             : $urlModel->getUrl('*/*/*');

         if ( $withAuth ) {
-            $phpAuthUser = $this->getController()->getRequest()->getServer('PHP_AUTH_USER', false);
-            $phpAuthPw = $this->getController()->getRequest()->getServer('PHP_AUTH_PW', false);
-            $scheme = $this->getController()->getRequest()->getScheme();
+            $phpAuthUser = rawurlencode($this->getController()->getRequest()->getServer('PHP_AUTH_USER', false));
+            $phpAuthPw = rawurlencode($this->getController()->getRequest()->getServer('PHP_AUTH_PW', false));
+            $scheme = rawurlencode($this->getController()->getRequest()->getScheme());

             if ($phpAuthUser && $phpAuthPw) {
                 $wsdlUrl = sprintf("%s://%s:%s@%s", $scheme, $phpAuthUser, $phpAuthPw,

change at Mage_Catalog_Model_Product_Api_V2

     public function create($type, $set, $sku, $productData, $store = null)
     {
-        if (!$type || !$set || !$sku) {
+        if (!$type || !$set || !$sku || !is_object($productData)) {
             $this->_fault('data_invalid');
         }

@@ -243,6 +243,9 @@ class Mage_Catalog_Model_Product_Api_V2 extends Mage_Catalog_Model_Product_Api
      */
     protected function _prepareDataForSave ($product, $productData)
     {
+        if (!is_object($productData)) {
+            $this->_fault('data_invalid');
+        }
         if (property_exists($productData, 'website_ids') && is_array($productData->website_ids)) {
             $product->setWebsiteIds($productData->website_ids);
         }

See more at: http://www.amitbera.com/magento-security-patch-supee-6482/

  • 1
    Hi Amit Bera (@amit-bera),where can I get the patch SUPEE-6482 in the form of a separate zip of Magento 1.9.2.1 ? – Andhi Irawan Aug 5 '15 at 2:52
  • 2
    @Andhi,magento 1.9.2.1 has been already included patch code at it code structure ,So you does not need to apply SUPEE-6482 – Amit Bera Aug 5 '15 at 3:15
  • 1
    @ Amit Bera, If still using Magento 1.9.1.0 whether to upgrade to 1.9.2.1? I mean, can only install the patch SUPEE-6428? – Andhi Irawan Aug 5 '15 at 3:35
  • 3
    Note that the unvalidated header patch is not in the CE patches, the following files are not touched => app/code/core/Mage/Core/Controller/Request/Http.php and app/design/frontend/base/default/template/page/js/cookie.phtml are among the missing. Maybe we should change the question at the top to read: Magento security patch SUPEE-6482, What isn't patched? – Fiasco Labs Aug 5 '15 at 5:57
  • 1
    @ Amit Bera, sorry, has been added by Magento at Added Aug 4, 2015 in magentocommerce.com/download : Download -> Magento Community Edition Patches -> SUPEE-6482 – Andhi Irawan Aug 5 '15 at 7:14
4

Please read Magento's documentation on this release, the answer is there: http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html

  • 5
    While informative consider copying the relevant section into this thread. A link-only-answer is not the best answer as links have a habit of disappearing (especially Magento documentation links!) – philwinkle Aug 4 '15 at 21:55
  • 1
    @philwinkle - Heh, yeah we've all been there. MagEbayVaporation (x_x) links galore. – Fiasco Labs Aug 5 '15 at 6:19
2

This patch, like other recent patches, contains a lot of copy, license, and typo fixes. It also introduces a few typos from what I have seen.

The actual security patch part appears to address user input sanitization for 4 different potential attacks.

protected by Community Aug 6 '15 at 4:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.