Questions tagged [security]
Denotes security questions on Magento.
1
vote
0answers
20 views
How to enable Two Factor Authentication for Customer Accounts
I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
1
vote
0answers
6 views
Creating custom 2FA provider
I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator).
Anybody who can point me in the right direction? I have been working with ...
3
votes
1answer
45 views
Do bound parameters get escaped using the Core/Resource model?
Consider the following example:
$connection = Mage::getSingleton('core/resource')->getConnection('core_read');
$email_address = $_GET['email'];
$sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
1
vote
1answer
43 views
Help! Credit Card Grabber Found on Magento 1.9
I've found a piece of code that contacts a really weird domain with CC info.
Can someone confirm it doing something malicious?
If so, what should I do without taking down the server? I'm a total ...
0
votes
0answers
12 views
Magento 2.2.2 - Restrict access to Admin and redirect to 404 if unautohrized
I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access
http://store.com/admin. Could think of ...
2
votes
1answer
120 views
is this a spam email or real
Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk>
Sent Date : Wed, 26 Dec 2018 22:03:27 +0000
From : magento@gohost.sk
Sender MailID : magento@gohost.sk
Reply To : magento@gohost.sk
To : ...
0
votes
0answers
15 views
ASV scan failing because of Session ID in URL
We're on a Magento 1.9.3.7 and our Aperia ASV scan is failing because of Session ID in URL.
One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384
Payload:...
0
votes
1answer
52 views
Magento 1 - Patch SUPEE-10415 is not applied
I have tried to apply path SUPEE-10415 to magento 1.9.1.0, but its won't succedeed.
Please find the report below.
Checking if patch can be applied/reverted successfully.
ERROR: Patch can't be ...
1
vote
1answer
29 views
Prevent Magento2 display information on script on homepage
I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
0
votes
1answer
135 views
Webgility Security Vulnerability Update [closed]
Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...
3
votes
0answers
411 views
Security Patch SUPEE-10975 - Possible issues? [duplicate]
Magento has released a new security patch for M1, and updates for M1 and M2.
What issues should I look out for when upgrading or applying this patch?
SUPEE-10975
SUPEE-10975, Magento Commerce 1....
1
vote
2answers
164 views
Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient
I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
1
vote
1answer
168 views
Problem with patch SUPEE-10888 on Magento 1.9.0.1
Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed:
Checking if patch can be applied/reverted successfully...
ERROR: ...
1
vote
0answers
27 views
New security threat to Magento caused by it using jQuery-File-Upload?
Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it.
Is this an issue for Magento and should ...
13
votes
12answers
3k views
SUPEE-10975 Potential Issues
SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support?
So far these ...
0
votes
0answers
16 views
Why does /soap not follow site X-FRAME header?
After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
3
votes
2answers
448 views
Webgility RCE vulnerability
MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility.
While their tool is very helpful in scanning the site and asserting ...
1
vote
1answer
160 views
How to remove malicious code from the each files of the website magento 2?
I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website?
Is any script to remove or replace this malicious code?
...
1
vote
2answers
58 views
Magento 1.9.3.2 - Exception printing is disabled by default for security reasons
I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error.
I have ...
2
votes
1answer
50 views
How to stop fake reviews and fake signups on Magento 1 and Magento 2?
We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
1
vote
2answers
65 views
I found some malicious code in all index.php of magento 1.9.2
Need help to stop malicious code in all index.php file
Once I remove malicious code from index.php then again its apperar in index.php files
malicious code like --
$swvJgN7="xQC+...
1
vote
2answers
96 views
Our Magento account was hacked; files deleted; hosting company is unable to restore
Magento 1.9.1
Porto theme
Managed VPS from Hostforweb
CentOS 7.x/WHM / Cpanel
We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
1
vote
1answer
88 views
Magento2 Two factor authentication for Frontend
Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
33 views
How to secure my website magento 2
I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so.
Also i want advice from you concerning sécurity ...
2
votes
1answer
39 views
How to create a nonce / secure hash in Magento 2?
I want a simple link to activate a customer out of an email that gets sent to the admin on registration.
I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
3
votes
2answers
59 views
Can anyone have any idea of security patch file of SUPEE-9652 V2?
As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
0answers
20 views
Access orders page with wget [duplicate]
people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like
wget -user myUserName -password myPassword ...
2
votes
0answers
86 views
Magento Security Scan reports Malicious Javascript without files
I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.
For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
0
votes
0answers
242 views
Magento known issue while upgrade from 1.9.3.9 to 1.9.3.10? [duplicate]
I just got notification that 1.9.3.10 is released with SUPEE-10888 curious to know if someone has already update it and faced any issue?
19
votes
16answers
5k views
Security Patch SUPEE-10888 - Possible issues?
SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues.
https://magento.com/security/patches/supee-10888
SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
1
vote
0answers
52 views
Magento 2 CE + CyberSource Checkout [closed]
I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error.
You are not authorized to view this page. The transaction has not been
processed. If the problem ...
1
vote
1answer
44 views
Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?
Magento 1.9.1
Porto theme
Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
0
votes
0answers
32 views
How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?
My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
0
votes
1answer
77 views
The site ahead contains malware Attackers currently on magento
My Website is not working from 3 days boheco.org(magento version- 1.9.3.4)
3
votes
2answers
238 views
Malware Attack On Magento 1.9.2
My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url
please help ...
1
vote
1answer
509 views
Using SVG logo in Magento 2.2.4
I am trying to upload an SVG logo for my Magento website, but it is not allowing me to upload an SVG file. It says that it is an unsupported file. Any idea how to resolve this?
Based on internet ...
0
votes
0answers
133 views
Magento 2 - Security : HTTP Only cookie
Our Security team raised security issue cookie setting and asked to set HTTP only and Secure cookie. Looks like Magento functionality overrides HTTP only parameter. To fix this issue we have set ...
0
votes
1answer
88 views
Data Security has been compromised
In my Magento 1.9 store, some of the Customer's Default Billing name and Address
has been amended. I first got to know this when one of my customer complained to me about their name that has been ...
1
vote
0answers
55 views
I have Chinese chars in the contents of my session files. Have I been hacked?
I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
2
votes
0answers
81 views
Is Magento 2 REST API CSRF-proof?
As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
1
vote
1answer
142 views
Magento 2 : What's the best practice when it comes to escaping in templates?
This is a question about best practices when it comes to writing templates / block classes and security.
When it comes to writing templates I know you need to escape everything that comes into the ...
0
votes
1answer
115 views
What is the data encryption / hashing key management method used in Magento 2
Like in the title.
What is the data encryption / hashing key management method used in Magento 2?
I found this question Encryption Method Used by Magento Enterprise, however, is the same method used ...
0
votes
0answers
36 views
Magento 1.9.1 error while security patches SUPEE-3941
When I am trying to install any patches it will give me error like below,
ERROR: Patch can't be applied/reverted successfully.
patching file downloader/Maged/Model/Connect.php
Hunk #1 FAILED at 486.
...
0
votes
0answers
16 views
How to restrict magento rest API,it is only accessible by https?
I want to access API with HTTPS only.If anyone access my API with HTTP,it does not work.How can achieve it?
1
vote
2answers
427 views
Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2
Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted ...
0
votes
0answers
25 views
Mganto1.9 : Item (Mage_Sales_Model_Order) with same id already exist
After I migrate my Magento shop from one hosting provider to another one I have a big problem. When I want to go in back to administration into sales->order I get an error
There has been an ...
1
vote
2answers
121 views
Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts
I have been scanning the website at Magento Scan and getting the following error:
Magento Compromise Injection
Your site is compromised with injected JavaScript. (131)
The malicious code ...
14
votes
14answers
7k views
Security Patch SUPEE-10752 - Possible issues?
A new security patch is out for Magento 1, addressing 25 APPSEC issues
https://magento.com/security/patches/supee-10752
What common issues do you have to watch out for when applying this patch?
...
0
votes
0answers
28 views
Why is customer/section/* accessible publicly? Can we hide this?
I am relatively new to Magento 2. I have created a store and ran security scan and noticed I have the following:
URL: https://www.mystore.com/customer/section/load/install/ or https://www.mystore.com/...
2
votes
1answer
2k views
Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:
I don't know what it's means and how to remove this error.
it's showing in my chrome console . but not in firefox console..
(index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
