I got a few warnings today on my site which I assume is some sort of attack on the website. Some sort of XML injection.

Is this something I need to be worried about for a Magento installation. Does it indicate a missing security patch or something else?

Warning: SimpleXMLElement::__construct() [<a href='simplexmlelement.--construct'>simplexmlelement.--construct</a>]: I/O warning : failed to load external entity "file:///etc/passwd" in ......./Request.php on line 308 
  • Do these files actually exist or do you just see this error in your logs? Which logs specifically? – SR_Magento Aug 29 '15 at 19:54
  • The file /etc/passwd doesn't exist. The directory structure doesn't exist for this. My concern was that due to some XML injection? request.php attempted to load the file (even if it didn't exist). I was concerned that there was a security issue such that they could load something more serious like the local.xml and config.xml files which have all the important cred's. The warning would have come from exception.log or system.log. – Ericc Aug 30 '15 at 0:07

This looks like "Path Traversal" attack take a look at this

The following URLs show examples of *NIX password file exploitation. http://some_site.com.br/../../../../etc/shadow
http://some_site.com.br/get-files?file=/etc/passwd Note: In a windows system an attacker can navigate only in a partition that locates web root while in the Linux he can navigate in the whole disk.

more on that

It is an attack on the server not magento itself. Error in your logs says this attack failed. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.