Questions tagged [security]
Denotes security questions on Magento.
631
questions
0
votes
0answers
17 views
The search term shows SQL injection in magento 1.9
I have found below search term on my magento 1.9's admin panel:
epoxy) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- QBrO
../../../../../../../../etc/passwd
AND 1=2 UNION SELECT ...
0
votes
1answer
37 views
Phishing Attack - Magento 1.9 - Too many Get method request for customer login page - Site Down
The IP : 167.172.230.190 hit my customer login page too many hits makes my server down
Screenshot : https://snipboard.io/kde4fw.jpg
Notes : Custom login page captcha enabled, added that IP in IP ...
0
votes
0answers
14 views
Magento Public Honeypot blacklist for LFD (or other firewall)
Several projects exist where malicious IP's are recorded or stored (DOS attacks, spam attack, brute force) ... and I was wondering if the Magento community also has 1 shared list of IPs specifically ...
1
vote
1answer
23 views
Two-Factor Authentication Invalid in Magento 2 admin panel
My client enabled 2FA (Two-Factor Authentication) in the Magento 2 admin panel, but every time that I scan the code to have it configured in my Google Authenticator and try to enter the code, it's ...
0
votes
0answers
9 views
M2 Session Cookie “Secure” when only serving https
A security researcher pointed out to us that the session cookie PHPSESSID does not have the secure attribute.
Looking around in magento admin panel I could not find the option to change that and ...
0
votes
0answers
15 views
How to implement Google Recaptcha in Custom Form?
In Magento 2.3 we are allowed to implement Google Recaptcha as described in the following link
https://docs.magento.com/user-guide/v2.3/stores/security-google-recaptcha.html
How can I add the same ...
0
votes
1answer
16 views
Basic Auth / Restricting backend admin panel for M1
Good evening.
Should it not be possible toeither restrict or use basic auth on the admin panel for login? Just as an extra security layer.
Can there be any flaws/errors regadring 3rd party extentions ...
0
votes
0answers
23 views
Is rest/default/V1/guest-carts/ vulnerable?
I'm running M2.3.5. Every so often I'll get a small batch of errors from IPs outside my country (all US). I'm getting notifications in the form of Store Debug Errors. Here's an example:
URL: https://...
2
votes
1answer
145 views
Magento 2 module to log failed login attempts, for Fail2ban
I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily.
E.g. for every failed login attempt, the module would add a line ...
1
vote
0answers
20 views
Magento 2 - How to apply security patch?
In Magento 2 after a security report. I have this action to perform :
Apply the Magento 2.2.7/2.1.16 Security Update immediately. Review your
site for signs of compromise. Find more information about ...
1
vote
1answer
105 views
Sanitizing HTML output in templates in 2.4
Before 2.4 the way you could sanitize an html value in a template was to use $block->escapeHtml($valueHere);.
Where $blick is the instance of the current block.
This still works in 2.4, but the ...
0
votes
0answers
11 views
magento1 security patch issue
When run the security scan with base url.
example: www.testurl.com
all patchs are updated
when run add the store code to base url
example: www.testurl.com/us
10415 patch is failed
can I know the ...
0
votes
1answer
30 views
Magento 2 and SELinux
So it turned out that SELinux is causing all the issues I've been having with USPS shipping calculation and Paypal redirecting.
This is my current stack:
2.3.5p1
CentOS 8
PHP 7.3.18
Apache/2.4.37
...
0
votes
0answers
9 views
How to apply a patch on plugins on Magento 1?
I should be applying security patches on a Magento 1 with several modules/plugins.
In addition to the files in /local/Mage, I should also apply the patch to plugins that extend the classes of the ...
0
votes
0answers
15 views
Magento 1.9 and 2.3 admin details scrape attempts
I'm not sure if this is the best place for this post... I checked around and it didn't seem like there was anywhere else to post it.
I just upgraded from Mage 1.9 to 2.3. In the last few months I ...
0
votes
0answers
8 views
Why is admin user's password stored in two tables?
The password of an admin user is stored in table admin_user (column password) and admin_password (column password_hash). What is the reason for storing it twice?
I don't understand why it is ...
1
vote
0answers
12 views
5 malicious files found in Magento with a malware scan - are they for real or false positive?
Magento 1.9.x
Softaculous installer in Cpanel
A malware scan on our server has detected the following 5 malicious files - are these really problematic or could these just be false positives?
/home/...
0
votes
2answers
121 views
Why is BitDefender flagging Magento 1 sites as containing malware
I'm not sure if this is the right place to ask this question, so apologies in advance.
I've just noticed that several Magento 1 sites I look after including development sites are now being blocked by ...
0
votes
0answers
45 views
SUPEE-11314v2: Potential Issues? [duplicate]
Magento released SUPEE-11314 on Apr 28, followed by an updated version SUPEE-11314v2 on May 12. They mention you should revert 11314, if you already applied it, before installing v2.
Description of ...
0
votes
1answer
20 views
Static content deploy generate thousands of weird folder names
i've run setup:static-content:deploy -f and now i'm getting a lot of strange folders on my pub/static/frontend folder For example one folder has the name "G7oLVFdw'; waitfor delay '0:0:6' -- " This ...
11
votes
11answers
7k views
Magento 2.3.5-p1 CSP font-src self unsafe-inline
In regarding to CSP I create own csp_whitelist, but still I am getting:
The Content Security Policy 'font-src 'self' 'unsafe-inline';
form-action secure.authorize.net test.authorize.net
geostag....
0
votes
4answers
2k views
How can I fix “Refused to load the stylesheet because it violates the following Content” in Magento 2.3.5
I've recently upgraded to Magento 2.3.5 and I've been encountering an issue with my Content Security Policy when trying to load a style sheet.
The error (Chrome dev console):
I've added maxcdn to ...
2
votes
1answer
2k views
Magento 2.3.5 Content Security Policy directive: "img-src
Upgrade to 2.3.5 and now getting this error bellow thought out the site on every page:
[Report Only] Refused to load the image
'blob:http://my.domayn.com/axxxxxxxxxxxx' because it violates the
...
6
votes
9answers
4k views
Security Patch SUPEE-11314 - Possible problems?
Magento have released new Magento 1 versions
1.14.4.5
1.9.4.5
The patch number is SUPEE-11314 and is available at https://magento.com/tech-resources/download
A summary (covering both M1 and M2 so ...
0
votes
0answers
22 views
How to install magento patch on old version
I have a 2.3.1 magento and i want to install the last security patch from 2.3.5.
Can your confirm me that i have to install a least the 2.3.4 magento version before ?
I am confused beceause With ...
0
votes
0answers
140 views
Magento 2 Security Patches Tracking
I need to understand this new Magento 2 patches.
So I see that security patches are released as 2.3.3-p1.
Let's say my version is Magento 2.3.2. And Magento has released 2.3.2-p1, 2.3.3-p1, 2.3.4-p1,...
2
votes
0answers
123 views
Implementing Google reCaptcha v.2 with Gene_Braintree module
Magento version EE 2.3.3-p1.
I was wondering if anyone out there has implemented core Msp_Recaptcha at checkout when using the BrainTree or Gene_BrainTree modules. We've been hit HARD by carding ...
1
vote
1answer
35 views
What's security-only patch release and how to apply it?
I noticed we have security-only patch releases, what's it and how to use it?
An example of these security-only patch releases, instead of having Magento 2.3.2 my client has installed Magento 2.3.3-p1....
0
votes
0answers
9 views
how to securely store data created by javascript code to the database
I would like to store some GDPR related data in the database for guest or registered users when consent is given.
My question is regarding safety precautions I should take.
The idea is that when ...
0
votes
0answers
21 views
Wrong URL for category image when root is set to pub directory
I want to use pub/ directory for security reasons as document root for Magento website but when i switch it, images for categories and for manufacturers (in product detail) are not displayed.
I ...
1
vote
1answer
58 views
Magento 2 Outdated JS Libraries - Failed. Outdated AngularJS library found Issue
We are using magento ver 2.2.4 and after run magento security scan tool, In generated report we found following error:-
Outdated JS Libraries - Failed.Outdated AngularJS library found,
response ...
1
vote
1answer
89 views
Profiler is enabled after a maintenance flag is created - malware?
It seems like the profiler on my site is automatically enabled after the site goes down in maintenance mode- Is there any reason why magento goes into maintenance mode and subsequently, the profiler ...
0
votes
0answers
145 views
Security Error - Bug Shooting return Data has been tampered error in Success page?
Magento 1.9 - Using Bug Shooting if i try to place an order i am getting response regard Data has been tampered. How to solve this security issue?
0
votes
0answers
90 views
Is SUPEE-11295 missing fixes?
Adobe's Security Bulletin APSB20-02 mentions 6 security issues. I've read through the changes in SUPEE-11295 and I don't think that all of these issues are getting addressed.
To my understanding, the ...
0
votes
0answers
157 views
magento 2 how to secure Cookie mage-cache-sessid and enable Secured Flag
Here Am trying to enable HttpOnly and Secured Flag for Cookies mage-cache-sessid or my domain. I did configuration in admin Panel >> store >> configuration >> general >> web
but still flags not ...
0
votes
0answers
14 views
Magento EE 1.14 security patch Hunk #1 FAILED at 68
I am trying to apply patches to Magento EE 1.14 version but i am facing following issue
checking file app/design/frontend/rwd/default/template/customer/form/changepassword.phtml
Hunk #1 FAILED at 43....
2
votes
0answers
498 views
How upcoming SameSite cookie changes could affect Magento or 3rd modules, possible issues?
On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies.
The ...
0
votes
0answers
29 views
Magento 2 How to secure my checkout success page?
So I have create completely custom checkout page and after successfull order Im receiving via my ajax call a "Increment Id" from backend.
With this increment Id I'm redirecting user to /checkout/...
-1
votes
2answers
33 views
Need magento 1.9.3.3 to apply patch
I want to know list of patches for my website which is in 1.9.3.3 version of magento please suggest.
1
vote
0answers
19 views
Unknown index “UsernamePasswordFormAuthenticve_index” in cron logfile - security issue?
Today i noticed a really strange index and code dump in cron.log: UsernamePasswordFormAuthenticve_index is successfully finished
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@...
0
votes
0answers
30 views
Which files under Magento webroot should be executable?
Security best practices suggest that you should never have an executable in a public web directory. However, in a typical Magento install (in my very limited experience), this is not true.
Even in ...
0
votes
1answer
51 views
Need help to stop malicious code in index.php file
Need help to stop malicious code in index.php file
Please help me if anyone have faced this same issue. I am using Magento ver. 1.9.4.3
index.php :
* @category Mage
*/
$swvJgN7="xQC+...
1
vote
0answers
67 views
Transparent Data Encryption in Magento 2.3 Database
I need to encrypt customer data (company name, contact person, emai, address, etc.) within the magento mysql database.
I'd like to realize this without introducing encryption/decryption in every ...
0
votes
0answers
45 views
Authentication type for API to be used by third party partners | Magento 2
We are creating an API in M2 enterprise edition to sell our giftcodes to a partner. The partner will have functionalities like:
To have Store Credit
Can buy giftcodes
View buy history
We cannot ...
0
votes
1answer
353 views
failed applying security patch SUPEE-11155 - Hunk #1 FAILED
patching file app/Mage.php
Hunk #1 FAILED at 813.
1 out of 1 hunk FAILED -- saving rejects to file app/Mage.php.rej
Can anyone point me in the right direction as to why I've a bunch of messages that ...
0
votes
0answers
62 views
Security patch 11219 risk error for Magento 1.9.2.4
Security patch 11219 risk Error for Magento 1.9.2.4
I'm using Magento 1.9.2.4 version
in the Security patch error(magereport.com)
But in the Magento Security patch not have this version (https://...
3
votes
1answer
65 views
Shell script dumps Model source code
Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the ...
9
votes
11answers
8k views
SUPEE-11219 Potential issues?
Magento just sent out an email about a new security patch (SUPEE-11219).
https://magento.com/security/patches/supee-11219
Affected versions:
Magento Commerce 1.9.0.0-1.14.4.1
Magento Open Source 1....
0
votes
1answer
105 views
Magento 2: Spam Customer Accounts Created Automatically
I am using Magento 2.2.4 for my e-commerce website. From last few days, customer accounts creating automatically on my website without the proper information. I already installed Mageplaza Security ...
0
votes
1answer
52 views
Any other way to increase the customer logged in time in Magento-1.9 without increasing server session time session.gc_maxlifetime?
Any other way to increase the customer logged in time without increasing server session time?
If we give a value as 78,00,000 seconds (3 months) for session.gc_maxlifetime in the php.ini file, then ...
