Magento security patch SUPEE-6482, What is patched?

Question

Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are the possible attacks that could affect and unpatched shop? What 's the worst that could happen?

Update: I just wanted to add the email magento sent today to complete the post.

Answer 1

The actual security patch (SUPEE-6482) only affects the two following files and is an API patch.

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php
app/code/core/Mage/Catalog/Model/Product/Api/V2.php

The full 1.9.2.1 install is a different matter altogether. I would diff source code between 1.9.2.0 and 1.9.2.1 to figure out the other two items that were patched.

Release notes are for the full installer, you have to check the patch to see if it actually includes all the items noted in the release notes.

Implications of running an unpatched server:

1. Cross-site Scripting Using Unvalidated Headers => Cache Poisoning
2. Autoloaded File Inclusion in Magento SOAP API => Remote code autoload
3. XSS in Gift Registry Search => Cookie theft and user impersonation
4. SSRF Vulnerability in WSDL File => Internal server info leak and remote file inclusion

NOTE: Files patched in the full install archive that are not patched with the patch, hmm?

diff -r magento-1920/app/code/core/Mage/Core/Controller/Request/Http.php magento-1921/app/code/core/Mage/Core/Controller/Request/Http.php
300a301
>         $host = $_SERVER['HTTP_HOST'];
302,303c303,304
<             $host = explode(':', $_SERVER['HTTP_HOST']);
<             return $host[0];
---
>             $hostParts = explode(':', $_SERVER['HTTP_HOST']);
>             $host =  $hostParts[0];
305c306,313
<         return $_SERVER['HTTP_HOST'];
---
> 
>         if (strpos($host, ',') !== false || strpos($host, ';') !== false) {
>             $response = new Zend_Controller_Response_Http();
>             $response->setHttpResponseCode(400)->sendHeaders();
>             exit();
>         }
> 
>         return $host;

diff -r magento-1920/app/design/frontend/base/default/template/page/js/cookie.phtml magento-1921/app/design/frontend/base/default/template/page/js/cookie.phtml
37,38c37,38
< Mage.Cookies.path     = '<?php echo $this->getPath()?>';
< Mage.Cookies.domain   = '<?php echo $this->getDomain()?>';
---
> Mage.Cookies.path     = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getPath()) ?>';
> Mage.Cookies.domain   = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getDomain()) ?>';

Answer 2

I hade a look at the changes in detail and which side effects are to expect.

In the version for EE 1.13.1.0 the following files changed:

2015-08-05 07:14:25 UTC | SUPEE-6482_EE_1.13.1.0 | EE_1.13.1.0 | v2 | 7e38036f94f250514fcc11d066a43c9bdb6a3723 | Tue Jul 28 14:29:35 2015 +0300 | v1.13.1.0..HEAD
patching file app/code/core/Enterprise/PageCache/Model/Processor.php
patching file app/code/core/Mage/Api/Model/Server/Adapter/Soap.php
patching file app/code/core/Mage/Catalog/Model/Product/Api/V2.php
patching file app/code/core/Mage/Core/Controller/Request/Http.php
Hunk #1 succeeded at 294 (offset 7 lines).
patching file app/design/frontend/base/default/template/page/js/cookie.phtml
patching file app/design/frontend/enterprise/default/template/giftregistry/search/form.phtml

• In Adapter/Soap.php, urlencoding is added to authentication data. This should have no negative side effect. It ensure, that the resulting wsdlUrl is valid. Without this change, one could influence the URL
• Product/Api/V2.php: Here are some checks if passed data is an object. This should not happen under normal circumstances.
• in Request/Http.php and PageCache/Model/Processor.php a check is added when getting the HTTP HOST. This seems to cover the header injections mentioned. The check only applies if there is a ; or , in the HTTP host, so this should be uncritical in real life systems / have no negative side effect.
• in the cookie.phtml escaping is added. So this has to be forward ported to your theme if you overwrite that file
• similar for giftregistry/search/form.phtml

To sum it up, I would say that applying the patch should not have any negative side effects. Remember to forward port the changes to your .phtml files.

Answer 3

Weird thing is that EE patch contains modifications on following files:

app/code/core/Mage/Core/Controller/Request/Http.php
app/design/frontend/base/default/template/page/js/cookie.phtml

When the CE one doesn't, for an equivalent version.

I presume there is something missing on that SUPEE-6482 CE version, and a V2 could be released soon.

Answer 4

Magento release patch SUPEE-6482 for fix for below issue in edition CE & EE

For Magento Community Edition:

• Autoloaded File Inclusion in Magento SOAP API
• SSRF Vulnerability in WSDL File

For Magento Enterprise Edition

• Autoloaded File Inclusion in Magento SOAP API
• SSRF Vulnerability in WSDL File
• Cross-site Scripting Using Unvalidated Headers

XSS in Gift Registry Search

Doing change at class

• Mage_Api_Model_Server_Adapter_Soap

• Mage_Catalog_Model_Product_Api_V2

Changes at Mage_Api_Model_Server_Adapter_Soap

             : $urlModel->getUrl('*/*/*');

         if ( $withAuth ) {
-            $phpAuthUser = $this->getController()->getRequest()->getServer('PHP_AUTH_USER', false);
-            $phpAuthPw = $this->getController()->getRequest()->getServer('PHP_AUTH_PW', false);
-            $scheme = $this->getController()->getRequest()->getScheme();
+            $phpAuthUser = rawurlencode($this->getController()->getRequest()->getServer('PHP_AUTH_USER', false));
+            $phpAuthPw = rawurlencode($this->getController()->getRequest()->getServer('PHP_AUTH_PW', false));
+            $scheme = rawurlencode($this->getController()->getRequest()->getScheme());

             if ($phpAuthUser && $phpAuthPw) {
                 $wsdlUrl = sprintf("%s://%s:%s@%s", $scheme, $phpAuthUser, $phpAuthPw,

change at Mage_Catalog_Model_Product_Api_V2

     public function create($type, $set, $sku, $productData, $store = null)
     {
-        if (!$type || !$set || !$sku) {
+        if (!$type || !$set || !$sku || !is_object($productData)) {
             $this->_fault('data_invalid');
         }

@@ -243,6 +243,9 @@ class Mage_Catalog_Model_Product_Api_V2 extends Mage_Catalog_Model_Product_Api
      */
     protected function _prepareDataForSave ($product, $productData)
     {
+        if (!is_object($productData)) {
+            $this->_fault('data_invalid');
+        }
         if (property_exists($productData, 'website_ids') && is_array($productData->website_ids)) {
             $product->setWebsiteIds($productData->website_ids);
         }

See more at: http://www.amitbera.com/magento-security-patch-supee-6482/

Answer 5

Please read Magento's documentation on this release, the answer is there: http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html

Answer 6

This patch, like other recent patches, contains a lot of copy, license, and typo fixes. It also introduces a few typos from what I have seen.

The actual security patch part appears to address user input sanitization for 4 different potential attacks.