Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are the possible attacks that could affect and unpatched shop? What 's the worst that could happen?

Update: I just wanted to add the email magento sent today to complete the post. Magento Email Update

  • 1
    I am sure there will be a wrap-up these days. However, if you checked it already and want to have a discussion, go ahead! Share your thoughts and findings!
    – mam08ixo
    Commented Aug 4, 2015 at 15:47
  • 2
    The patch itself, no. The full install for would have to be examined for those changes, at this point it seems to only address 4 security issues Commented Aug 4, 2015 at 18:43
  • 2
    You will have to do a full upgrade, or backport => CMS Block and Widget caching in magento-1921/app/code/core/Mage/Cms/Block/Block.php and magento-1921/app/code/core/Mage/Cms/Block/Widget/Block.php Commented Aug 4, 2015 at 18:54
  • 2
    merch.docs.magento.com/ce/user_guide/… - I've just wondered when the next patch will come after there was so much focus on headers the last days. And there it is!
    – hakre
    Commented Aug 4, 2015 at 20:37
  • 2
    @hakre - I'd read the patch contents before including headers, unless those headers are actually in the API. The full download has some patches in the http controller and javascript cookie template, but the 6482 patch doesn't. Commented Aug 4, 2015 at 22:35

6 Answers 6


The actual security patch (SUPEE-6482) only affects the two following files and is an API patch.


The full install is a different matter altogether. I would diff source code between and to figure out the other two items that were patched.

Release notes are for the full installer, you have to check the patch to see if it actually includes all the items noted in the release notes.

Implications of running an unpatched server:

  1. Cross-site Scripting Using Unvalidated Headers => Cache Poisoning
  2. Autoloaded File Inclusion in Magento SOAP API => Remote code autoload
  3. XSS in Gift Registry Search => Cookie theft and user impersonation
  4. SSRF Vulnerability in WSDL File => Internal server info leak and remote file inclusion

NOTE: Files patched in the full install archive that are not patched with the patch, hmm?

diff -r magento-1920/app/code/core/Mage/Core/Controller/Request/Http.php magento-1921/app/code/core/Mage/Core/Controller/Request/Http.php
>         $host = $_SERVER['HTTP_HOST'];
<             $host = explode(':', $_SERVER['HTTP_HOST']);
<             return $host[0];
>             $hostParts = explode(':', $_SERVER['HTTP_HOST']);
>             $host =  $hostParts[0];
<         return $_SERVER['HTTP_HOST'];
>         if (strpos($host, ',') !== false || strpos($host, ';') !== false) {
>             $response = new Zend_Controller_Response_Http();
>             $response->setHttpResponseCode(400)->sendHeaders();
>             exit();
>         }
>         return $host;

diff -r magento-1920/app/design/frontend/base/default/template/page/js/cookie.phtml magento-1921/app/design/frontend/base/default/template/page/js/cookie.phtml
< Mage.Cookies.path     = '<?php echo $this->getPath()?>';
< Mage.Cookies.domain   = '<?php echo $this->getDomain()?>';
> Mage.Cookies.path     = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getPath()) ?>';
> Mage.Cookies.domain   = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getDomain()) ?>';
  • 5
    I think the missing files fix the most critical "Cross-site Scripting Using Unvalidated Headers" issue. The "XSS in Gift Registry Seaerch" issue seems to be mistakenly added to the patch documentation for the CE version, as the Gift Registry is an EE-only feature. Commented Aug 5, 2015 at 6:41
  • 1
    Yep, I figured that it was important enough to apply the missing changes to my CE installation anyway and not wait for Magento to figure it out and send us a V2 patch when they get around to it. Cache poisoning and unfiltered user input used in cookie components seems like a biggie. Commented Aug 5, 2015 at 6:58
  • 1
    Magento has updated the documentation: both the "Cross-site Scripting Using Unvalidated Headers" and "XSS in Gift Registry Search" issues are marked as "For Magento Enterprise Edition Only". But in the meantime, Magento CE does contain fixes for the "Cross-site Scripting Using Unvalidated Headers" issue, or at least a part of it. Commented Aug 5, 2015 at 14:11
  • 1
    Heh, the CE short-change in action. CE doesn't have the Wishlist, but definitely needs the "Unvalidated Headers" issue to go away via patch, not documentation change. Oh, well... more of what we've come to expect. Commented Aug 5, 2015 at 15:01
  • 3
    For the record - according to our tests - Cross-site Scripting Using Unvalidated Headers is NOT a CE vulnerability. If anyone can provide a POC that there is a CE vulnerability, please go to magento.com/security and report it.
    – benmarks
    Commented Aug 5, 2015 at 20:01

I hade a look at the changes in detail and which side effects are to expect.

In the version for EE the following files changed:

2015-08-05 07:14:25 UTC | SUPEE-6482_EE_1.13.1.0 | EE_1.13.1.0 | v2 | 7e38036f94f250514fcc11d066a43c9bdb6a3723 | Tue Jul 28 14:29:35 2015 +0300 | v1.13.1.0..HEAD
patching file app/code/core/Enterprise/PageCache/Model/Processor.php
patching file app/code/core/Mage/Api/Model/Server/Adapter/Soap.php
patching file app/code/core/Mage/Catalog/Model/Product/Api/V2.php
patching file app/code/core/Mage/Core/Controller/Request/Http.php
Hunk #1 succeeded at 294 (offset 7 lines).
patching file app/design/frontend/base/default/template/page/js/cookie.phtml
patching file app/design/frontend/enterprise/default/template/giftregistry/search/form.phtml
  • In Adapter/Soap.php, urlencoding is added to authentication data. This should have no negative side effect. It ensure, that the resulting wsdlUrl is valid. Without this change, one could influence the URL
  • Product/Api/V2.php: Here are some checks if passed data is an object. This should not happen under normal circumstances.
  • in Request/Http.php and PageCache/Model/Processor.php a check is added when getting the HTTP HOST. This seems to cover the header injections mentioned. The check only applies if there is a ; or , in the HTTP host, so this should be uncritical in real life systems / have no negative side effect.
  • in the cookie.phtml escaping is added. So this has to be forward ported to your theme if you overwrite that file
  • similar for giftregistry/search/form.phtml

To sum it up, I would say that applying the patch should not have any negative side effects. Remember to forward port the changes to your .phtml files.

  • 1
    Thanks for the confirmation, the header injection and cookie component escaping are easy to backport to CE. Commented Aug 5, 2015 at 18:56
  • 1
    No need to port. There are patch versions also for CE in the download area.
    – Alex
    Commented Aug 6, 2015 at 20:36

Weird thing is that EE patch contains modifications on following files:


When the CE one doesn't, for an equivalent version.

I presume there is something missing on that SUPEE-6482 CE version, and a V2 could be released soon.

  • I thought the same thing!
    – rob3000
    Commented Aug 5, 2015 at 2:34
  • 2
    Yes, you noticed right. That's what I got by diffing the and installation archives. I have a fully patched CE installation due to this, I went ahead and manually patched the two files mentioned. The js cookie file needs to be patched in your custom template as well if you have that file in it. They probably skipped the request controller as a patch for it would have to patch a previously patched file and we got no CE love going on. Commented Aug 5, 2015 at 5:54
  • 1
    One more reason to "wait" some days before to deploy on production environment (and use these days to do better checks before going live). Today, one more update notification in Magento Backend (just the notice about the 2 instead of 4 security vulnerability ). Anyway, I'll wait until monday for going live, at least.
    – DarkCowboy
    Commented Aug 6, 2015 at 9:24
  • 1
    Magento has updated their release note: merch.docs.magento.com/ce/user_guide/… Some patches are effectively EE only. But I still don't get why those 2 files, core based, are not concerned in CE patch, as they are integrated in the CE Commented Aug 7, 2015 at 10:39

Magento release patch SUPEE-6482 for fix for below issue in edition CE & EE

For Magento Community Edition:

  • Autoloaded File Inclusion in Magento SOAP API
  • SSRF Vulnerability in WSDL File

For Magento Enterprise Edition

  • Autoloaded File Inclusion in Magento SOAP API
  • SSRF Vulnerability in WSDL File
  • Cross-site Scripting Using Unvalidated Headers

XSS in Gift Registry Search

Doing change at class

  • Mage_Api_Model_Server_Adapter_Soap

  • Mage_Catalog_Model_Product_Api_V2

Changes at Mage_Api_Model_Server_Adapter_Soap

             : $urlModel->getUrl('*/*/*');

         if ( $withAuth ) {
-            $phpAuthUser = $this->getController()->getRequest()->getServer('PHP_AUTH_USER', false);
-            $phpAuthPw = $this->getController()->getRequest()->getServer('PHP_AUTH_PW', false);
-            $scheme = $this->getController()->getRequest()->getScheme();
+            $phpAuthUser = rawurlencode($this->getController()->getRequest()->getServer('PHP_AUTH_USER', false));
+            $phpAuthPw = rawurlencode($this->getController()->getRequest()->getServer('PHP_AUTH_PW', false));
+            $scheme = rawurlencode($this->getController()->getRequest()->getScheme());

             if ($phpAuthUser && $phpAuthPw) {
                 $wsdlUrl = sprintf("%s://%s:%s@%s", $scheme, $phpAuthUser, $phpAuthPw,

change at Mage_Catalog_Model_Product_Api_V2

     public function create($type, $set, $sku, $productData, $store = null)
-        if (!$type || !$set || !$sku) {
+        if (!$type || !$set || !$sku || !is_object($productData)) {

@@ -243,6 +243,9 @@ class Mage_Catalog_Model_Product_Api_V2 extends Mage_Catalog_Model_Product_Api
     protected function _prepareDataForSave ($product, $productData)
+        if (!is_object($productData)) {
+            $this->_fault('data_invalid');
+        }
         if (property_exists($productData, 'website_ids') && is_array($productData->website_ids)) {

See more at: http://www.amitbera.com/magento-security-patch-supee-6482/

  • 1
    Hi Amit Bera (@amit-bera),where can I get the patch SUPEE-6482 in the form of a separate zip of Magento ? Commented Aug 5, 2015 at 2:52
  • 2
    @Andhi,magento has been already included patch code at it code structure ,So you does not need to apply SUPEE-6482
    – Amit Bera
    Commented Aug 5, 2015 at 3:15
  • 1
    @ Amit Bera, If still using Magento whether to upgrade to I mean, can only install the patch SUPEE-6428? Commented Aug 5, 2015 at 3:35
  • 3
    Note that the unvalidated header patch is not in the CE patches, the following files are not touched => app/code/core/Mage/Core/Controller/Request/Http.php and app/design/frontend/base/default/template/page/js/cookie.phtml are among the missing. Maybe we should change the question at the top to read: Magento security patch SUPEE-6482, What isn't patched? Commented Aug 5, 2015 at 5:57
  • 1
    @ Amit Bera, sorry, has been added by Magento at Added Aug 4, 2015 in magentocommerce.com/download : Download -> Magento Community Edition Patches -> SUPEE-6482 Commented Aug 5, 2015 at 7:14

Please read Magento's documentation on this release, the answer is there: http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-

  • 5
    While informative consider copying the relevant section into this thread. A link-only-answer is not the best answer as links have a habit of disappearing (especially Magento documentation links!)
    – philwinkle
    Commented Aug 4, 2015 at 21:55
  • 1
    @philwinkle - Heh, yeah we've all been there. MagEbayVaporation (x_x) links galore. Commented Aug 5, 2015 at 6:19

This patch, like other recent patches, contains a lot of copy, license, and typo fixes. It also introduces a few typos from what I have seen.

The actual security patch part appears to address user input sanitization for 4 different potential attacks.

Not the answer you're looking for? Browse other questions tagged or ask your own question.