Questions tagged [security]
Denotes security questions on Magento.
650
questions
0
votes
0
answers
30
views
custom VCL script for Fastly to prevent bots attack
Currently, our Magento is using Fastly. Last month, we got attacked by bots. They are trying to place the order as a guest thru an API call. Is there any VCL script that I can write in Fastly, so I ...
- 604
0
votes
2
answers
29
views
Magento 2.3.7 orders mysteriously disappeared
I'm hoping this isn't an indication of some kind of breach/vulnerability.
We recently discovered two orders where the buyers attempted to execute php using the ShipTo name. The code meant to append a ...
- 66
1
vote
1
answer
44
views
How can i check Magento site request comes from other unknown website in Magento 2?
for my Magento site marketing I use backlink,so some backlinks are right and some others are not not ok I need to block my site access from unknow sites backlink.
i used htacces code but that not ...
- 461
0
votes
1
answer
56
views
Magento2 - Secure your store from CSRF
Can anyone let me know how can I Secure store from CSRF. I am facing vulnerability issue like - Form Can Be Manipulated with Cross-Site Request Forgery (CSRF). Is this issue solved in Magento 2.4.4 ...
- 69
0
votes
2
answers
204
views
I get a strange search result when searching a couple of collections, but others are as they should be
It's puzzling.
For example, when I search for "classic", I get a strange search result:
Related search terms
classic style 394
classic') AND 6096 IN (SELECT
(CHAR(113)+CHAR(106)+CHAR(120)+...
- 1
0
votes
0
answers
116
views
Malware code inside pub/index.php
I have found a few lines of code inside my pub/index.php file
I am sure that my website is not hacked and this code is added by 1 of the developers. There are a
few developers working on the website. ...
- 648
1
vote
0
answers
38
views
Magento2 Malware and security issues
We noticing since last few months that Magento instances are affecting of malware on the Magento2 sites? For example:
health_check.php attack - this file compromised
Credit card fields were update ...
1
vote
1
answer
95
views
Are the security fixes for Cross-Site Scripting introduced in 2.4.5-p1 and 2.4.4-p2 relevant to 2.4.3 systems?
Some of our shops are still running on 2.4.3-p3.
From how I understand the most recent security patch notes, the security issues concerning Cross-Site Scripting are only relevant for 2.4.4 and 2.4.5 ...
- 39
1
vote
1
answer
955
views
Magento 2.4.4 - Can not resolve reCAPTCHA parameter
I just installed a new Magento 2.4.4 and configured the captcha inside Configuration > Security > Google reCAPTCHA Admin Panel.
I tried configuring:
reCAPTCHA v2 ("I am not a robot")
...
- 12.6k
3
votes
12
answers
5k
views
Magento 2: Fake customer order came through with weird code instead of customer name
Just had a fake order come through on my Magento 2 website. The address is nonsense and instead of a customer name it had this code:
{{
var this.getTemplateFilter().filter($order.shipping_address....
- 31
0
votes
0
answers
232
views
Magento 2: NO RATE LIMIT IMPLEMENTED
During Penetration Test Scan it is found that website did not implement any rate-limiting on contact us page, Attacker can submit multiple forms and spam the database with false queries.
...
- 829
0
votes
0
answers
168
views
How to resolve content security policy I want to add ADA Compliance from in magento 2.4.3?
I want to whitelist my ADA Compliance script into magento_csp for that i have created CSP_whitelist.xml for resolve following error
Error : Refused to load the script 'https://acsbapp.com/apps/app/...
- 41
0
votes
0
answers
31
views
Unrecognized REST API order created
We have noticed a new order created in the admin which has come from the REST API. (Order was automatically cancelled)
We have nothing running that creates orders in this way and the IP country and ...
- 529
2
votes
1
answer
49
views
How to Configure Magento 2 Security Scan?
Can anyone please explain STEP-BY-STEP PROCESS TO CONFIGURE MAGENTO 2 SECURITY SCAN?
Thanks
- 416
1
vote
2
answers
326
views
Security update for Magento Open Source APSB22-12 Which version?
I need to run the new security patches on Magento Open Source 2.4.3 - 2.4.3-p1 but Adobe don't actually elaborate on how to choose the correct version. My guess would be the COMPOSER version, but I ...
- 182
1
vote
1
answer
863
views
Magento2.4.2 Too many password reset requests
About to migrate. I get this issue for Admins. I need to disable this so my team (18 people) can choose their own passwords.
Can I disable this ? If only for an hour or so.
- 73
0
votes
1
answer
42
views
Do Security updates require a compile?
I would like to apply the security hotfix for the recently found vulnerabilites: https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12-
Is ...
- 39
1
vote
1
answer
310
views
How to know if my ElasticSearch is vulnerable against Log4j?
I don't have Java installed in my main Docker, but I'm using ElasticSearch v6.8.3 in another instance.
curl -XGET 'http://localhost:9200'
Am I vulnerable against Log4j even not running ElasticSearch ...
- 12.6k
1
vote
2
answers
488
views
How to check Log4j in Magento installation?
I don't know if my Magento server is infected by Log4j, how could I check it?
- 12.6k
1
vote
1
answer
738
views
Prevent Bot traffic with .htaccess on Magento 2?
How to prevent(block) bad bots traffic with .htaccess for Magento 2 ? What you recommend ?
I do not know how to do this.
And which codes in .htaccess I need to modify.
Or Do we have any other ...
- 11
1
vote
2
answers
282
views
Magento2 Apply Patches
I have some customers that use some "older" Magento 2 versions, like for example 2.3.4.
I would like to keep the store updated with the latest security patches but without doing a full ...
0
votes
1
answer
240
views
Unable to find 2FA tab under security tab in store configuration
I want to enable 2FA for admin login in Magento 2.4.2 but it is missing.
Thanks
- 962
0
votes
0
answers
115
views
JavaScript url being stripped out of html
I have a very odd issue happening that I have been struggling with and can't find answer to. We have a 3rd party module to add GTM to the site and after doing a deploy the GTM is fine. After a ...
- 269
-1
votes
1
answer
2k
views
How to disable Magento 2 Content Security Policy with theme edit only
I have searched alot on the internet and I want to hide this error (magento 2.4)
content security policy error , we don't have authority to disable magento_csp module and we can not create module, we ...
- 168
0
votes
1
answer
100
views
Make action available only for admin
I added a button to admin order view which sends request to an url of an action controller (using ajax), and now I need to somehow make it available only for admin. What is the best solution for this ...
1
vote
1
answer
106
views
Security issue ? User with restricted scope can access ALL orders on a multiwebsite setup
Using Magento Cloud EE here but this issue might be the same on CE I'm not sure.
Create user foo
Create role test
Assign foo to test
Restrict website scope for test to www.website1.com only
Login ...
- 128
1
vote
0
answers
52
views
Magento 2.2 - Mage-Report Exposed Magento 2 API
Magento 2.2.3
I have scan the website in Mage Report, How to solve Exposed Api issue. What magento2 patch for this instead to upgrade version.
- 1,298
0
votes
1
answer
212
views
Payment Failed Emails M 2.3.5 - Not working for us
We are currently using Magento 2.3.5
From my understanding, payment failed emails are sent when a transaction fails. By fails I hope that this means it is declined or voided by the payment method. ...
- 31
1
vote
0
answers
106
views
prevent brute force attacks on the discount codes
Is there a way to prevent brute force attacks on the discount code input eg limit the number of discount codes a customer can enter a day?
- 2,529
1
vote
1
answer
415
views
Script injection below body tag in Magento 2.4.1
I upgraded our Magento from 1.9 to 2.4.1 after we found malware that was trying copy customer credit cards before allowing the customer to use PayPal.
I used Magento's migration tools to copy data to ...
- 11
1
vote
0
answers
212
views
"Catalog Search index process unknown error:" 403 Forbidden
My System info:
Apache2 /php7.4(mod-security, mod_proxy) /Mysql8 /Elastic7.10
After a fresh installation of M2.4 and configure it for the E7 with Apache proxy port 8080 to 9200. When I tried to run ...
- 13
1
vote
1
answer
363
views
Is the Magento 2 file system allowed to be owned by www-data? + Permissions question
I work at a company where I noticed that most of our Magento 2 file system is owned by www-data and in the www-data group on our Ubuntu server.Furthermore, the docroot directory /var/www/<...
- 127
0
votes
1
answer
725
views
How to check Magento Cloud patches available?
My Magento 2.3 Cloud is not updated, and I see some issues that when I reporting to Magento they send me a patch already released.
Is there a way to see the list of patches available?
- 12.6k
0
votes
1
answer
199
views
How to fix XSS in website in url ? Magento 1
I can see that browsing url like this
https://www.anywebsite.com/?p=%3Cscript%3Ealert(document.cookie)%3C/script%3E
shows alert into browser window.
Is their any way to prevent it ? its XSS.
- 2,790
0
votes
0
answers
57
views
Category/search images not showing in Firefox
I get Content Security Policy errors in Firefox. I have a CSP module that handles this just fine in Chrome, but this remains an issue in Firefox. Are there more steps that have to be taken to make ...
- 313
0
votes
1
answer
74
views
Phishing Attack - Magento 1.9 - Too many Get method request for customer login page - Site Down
The IP : 167.172.230.190 hit my customer login page too many hits makes my server down
Screenshot : https://snipboard.io/kde4fw.jpg
Notes : Custom login page captcha enabled, added that IP in IP ...
- 145
2
votes
2
answers
2k
views
Two-Factor Authentication Invalid in Magento 2 admin panel
My client enabled 2FA (Two-Factor Authentication) in the Magento 2 admin panel, but every time that I scan the code to have it configured in my Google Authenticator and try to enter the code, it's ...
- 12.6k
0
votes
1
answer
81
views
Basic Auth / Restricting backend admin panel for M1
Good evening.
Should it not be possible toeither restrict or use basic auth on the admin panel for login? Just as an extra security layer.
Can there be any flaws/errors regadring 3rd party extentions ...
2
votes
1
answer
783
views
Magento 2 module to log failed login attempts, for Fail2ban
I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily.
E.g. for every failed login attempt, the module would add a line ...
- 1,334
10
votes
1
answer
3k
views
Sanitizing HTML output in templates in 2.4
Before 2.4 the way you could sanitize an html value in a template was to use $block->escapeHtml($valueHere);.
Where $blick is the instance of the current block.
This still works in 2.4, but the ...
- 197k
0
votes
1
answer
171
views
Magento 2 and SELinux
So it turned out that SELinux is causing all the issues I've been having with USPS shipping calculation and Paypal redirecting.
This is my current stack:
2.3.5p1
CentOS 8
PHP 7.3.18
Apache/2.4.37
...
- 33
1
vote
0
answers
45
views
5 malicious files found in Magento with a malware scan - are they for real or false positive?
Magento 1.9.x
Softaculous installer in Cpanel
A malware scan on our server has detected the following 5 malicious files - are these really problematic or could these just be false positives?
/home/...
- 114
0
votes
2
answers
322
views
Why is BitDefender flagging Magento 1 sites as containing malware
I'm not sure if this is the right place to ask this question, so apologies in advance.
I've just noticed that several Magento 1 sites I look after including development sites are now being blocked by ...
- 53
0
votes
1
answer
93
views
Static content deploy generate thousands of weird folder names
i've run setup:static-content:deploy -f and now i'm getting a lot of strange folders on my pub/static/frontend folder For example one folder has the name "G7oLVFdw'; waitfor delay '0:0:6' -- " This ...
19
votes
10
answers
29k
views
Magento 2.3.5-p1 CSP font-src self unsafe-inline
In regarding to CSP I create own csp_whitelist, but still I am getting:
The Content Security Policy 'font-src 'self' 'unsafe-inline';
form-action secure.authorize.net test.authorize.net
geostag....
- 1,449
5
votes
4
answers
13k
views
How can I fix "Refused to load the stylesheet because it violates the following Content" in Magento 2.3.5
I've recently upgraded to Magento 2.3.5 and I've been encountering an issue with my Content Security Policy when trying to load a style sheet.
The error (Chrome dev console):
I've added maxcdn to ...
- 769
6
votes
2
answers
13k
views
Magento 2.3.5 Content Security Policy directive: "img-src
Upgrade to 2.3.5 and now getting this error bellow thought out the site on every page:
[Report Only] Refused to load the image
'blob:http://my.domayn.com/axxxxxxxxxxxx' because it violates the
...
- 2,329
8
votes
10
answers
5k
views
Security Patch SUPEE-11314 - Possible problems?
Magento have released new Magento 1 versions
1.14.4.5
1.9.4.5
The patch number is SUPEE-11314 and is available at https://magento.com/tech-resources/download
A summary (covering both M1 and M2 so ...
- 4,422
0
votes
0
answers
44
views
How to install magento patch on old version
I have a 2.3.1 magento and i want to install the last security patch from 2.3.5.
Can your confirm me that i have to install a least the 2.3.4 magento version before ?
I am confused beceause With ...
0
votes
0
answers
734
views
Magento 2 Security Patches Tracking
I need to understand this new Magento 2 patches.
So I see that security patches are released as 2.3.3-p1.
Let's say my version is Magento 2.3.2. And Magento has released 2.3.2-p1, 2.3.3-p1, 2.3.4-p1,...
- 8,290