0

I installed the security patch SUPEE 7405 by shell. The output said that the patch was successfully installed:

Checking if patch can be applied/reverted successfully...
Patch was applied/reverted successfully.

The command grep '|' app/etc/applied.patches.list shows me that the patch is installed: 2016-01-26 12:42:44 UTC | SUPEE-7405-CE-1-9-2-2 | CE_1.9.2.2 | v1 |

I also checked some PHP files that had to be patched and they were.

The cache were cleared after installing.

The problem is that the XSS attack is still possible.

magereport.com said that the patch is not installed.

Any ideas?

Improve this question
3
  • how thought XSS attack is possible?
    – Amit Bera ♦
    Jan 28, 2016 at 10:56
  • you still have some files in app/code/local/Mage/
    – MagenX
    Jan 28, 2016 at 14:56
  • This is a stored XSS issue caused by the failure to apply escapeHtml() on the user's email address in admin templates. The email address is client-side validated and the validation can be bypassed by turning off javascript or doing a direct curl post to create the front end user account. In the case of template patches, you must pay attention to patching your custom templates AND add-in module templates to the same security level that the base system is being patched to.
    – Fiasco Labs
    Jan 29, 2016 at 3:00

1 Answer 1

Reset to default
2

This answer contains a list of patched files: https://magento.stackexchange.com/a/98232/243 (you can also look it up in applied.patches.list.

Please check if you override any of them in your custom theme or in code/local. Then you need to patch these files manually.

Also check for class rewrites that might override the patched methods (see: How do I get a list of all class rewrites?)

As a suggestion, check this post about the beta status of magereport, it explains how the check is done and may help you find the problem: http://support.hypernode.com/knowledgebase/security-checks-in-beta/

Improve this answer
3
  • 1
    Thank you! I patched the files in app/code/local/Mage manually. I found out that there were some files of a custom module I had to patch manually too. It is still possible to insert JavaScript but it has no more effect. Is that normal?
    – user3684098
    Jan 28, 2016 at 15:37
  • If you see <script>... but it does not execute, the XSS prevention works as intended.
    – Fabian Schmengler
    Jan 28, 2016 at 15:40
  • Every time a patch is released, you must check through the .phtml files patched and reflect those changes into your custom template's .phtml files. Sometimes you will have modules that have their own templates as well that override your custom template and Magento base template leading to a need to fix every one in the chain so that if you ever disable or discontinue use of the module, your theme will pick up the patch.
    – Fiasco Labs
    Jan 29, 2016 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.