Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
0
votes
1answer
17 views

Magento 2 : How can I stop SQL attack through search bar

It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
0answers
13 views

*Why save magento visitor happen only when POST/PUT request?

I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
10 views

How I can add security patch for magento 2.2.6 without updating magento

I have Magento 2.2.6 I want to update security patch I have lost my server databases (maybe SQL injection) my questions 1)How to update security patches? 2)Is it will helpful? 3)Is ...
18
votes
8answers
6k views

Magento 2: “Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider”

My Magento 2 development environment has started poking me with the following error message Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact ...
2
votes
2answers
2k views

Credit Card Hijack Malware Detected

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype....
24
votes
17answers
5k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
0
votes
2answers
59 views

Magento 2, XSS Patch not detected (APPSEC-2143)

In Magento security scan I got the below message for my Magento instance: XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143) I am using Magento 2.2.3 How could I resolve this? Is ...
5
votes
3answers
2k views

Magento 2: When/Why to do customer:hash:upgrade?

When I run below command, it gives below output. $ php bin/magento customer:hash:upgrade . Finished What actually this command do? When I have to run this command? What changes it will do? Will ...
26
votes
18answers
5k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
0
votes
1answer
52 views

Magento 2, Magento Unprotected XML

I have one Magneto 2.2.3 instance and when we check for security scan it is showing below error: We have determined that your Magento installation's configuration file(s) are publicly accessible over ...
0
votes
0answers
26 views

Magento 2 factor authentication

Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9. This is the extension release ...
4
votes
2answers
5k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
0
votes
2answers
61 views

Magento 2 security scan failed AngularJS and XS Vulnerability

Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
2
votes
1answer
23 views

How to secure Magento 2.x guest API

I realized that it is possible to register customers through API without authentication. https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html Just make a POST call to https://...
2
votes
2answers
242 views

Is it safe to have composer in production?

Is it safe/ok to have composer in production on a server hosting Magento?
1
vote
1answer
32 views

How secure is the Magento 2 File Uploader

I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is? I already ...
2
votes
1answer
605 views

Restricting access to anonymous web APIs

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html By default magento 2 only restrict Catalog, Store and CMS API from anonymous users. In a ...
0
votes
0answers
16 views

Hideit input on other forms

I stumbled across hideit input on contact us form https://magento.stackexchange.com/a/107656/70343 Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
2
votes
2answers
39 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
45 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
2
votes
1answer
959 views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
2
votes
1answer
669 views

Backend repeatedly hacked in version 1.9.1.0 CE by changing Paypal account info. How to fix and secure?

Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of ...
0
votes
2answers
32 views

Magento 2 remove version number impact

I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it. to prevent this I can disable the ...
3
votes
0answers
16 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
0
votes
0answers
24 views

Magento 2: Is there any site which is showing missing security patch?

Is there any website which is provide a report about missing security patch or which need to install ? I just need to install patch in magento 2.1.9.
1
vote
0answers
17 views

Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string

PHP 5.5.38 Magento 1.9.3.2 I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
1
vote
2answers
69 views

Document root change help

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache. I did the ...
3
votes
1answer
36 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
16
votes
15answers
6k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
7
votes
6answers
6k views

Check my Magento security status

I just had trouble to install the SUPEE-1533 and SUPEE-5344 on CE 1.7.0.0. I did it through the FTP method from Magentary. Question is then : how can I make sure that my Magento install got all ...
1
vote
4answers
68 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
3
votes
0answers
87 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
0
votes
1answer
50 views

Magento 2 Set Previous Password History

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
1answer
58 views

Is it better to use Vue.js storefront as a frontend for magento 2?

We have to lunch a new store and planning to use Vue.js storefront on frontend. -> Will it be feasible easily - data will be interchanged using APIs -> Would there be any security issues ? -> Any ...
0
votes
0answers
13 views

Issues on blocking magento website

Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it. Also no one blocked my website in the office. Still i am not able to open it in the office ...
1
vote
3answers
98 views

magento 1 malicious code attack in app/Mage.php

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
0
votes
1answer
25 views

Magento 2 recommended approach to applying patches

So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
1
vote
0answers
102 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
1
vote
0answers
19 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
2answers
193 views

Unableto verify site on Magento Security Scan

I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
3
votes
1answer
82 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
21 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
2
votes
1answer
4k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
1
vote
0answers
59 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
3
votes
1answer
426 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
1
vote
2answers
81 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
0
votes
0answers
23 views

Do I need to update to 2.3.1?

If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
0
votes
1answer
92 views

Want to install SUPEE-11086 patch for magento 1.9.2.0 version

I want to install SUPEE-11086 patch Magento 1.9.2.0 version. Does anyone have an idea about this?
2
votes
1answer
39 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
0
votes
2answers
52 views

HTTPS security is compromised by http://www.mfeuk.co.uk/js/mt/widget/frontend.js

can anyone help with this, I'm not anywhere close to calling myself proficient in magento but can normally track most things by trial and error, I have the problem that on my checkout page I have ...