Questions tagged [security]

Denotes security questions on Magento.

83 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
241 views

Using the secret admin frontname in a new adminhtml router

I have a module that uses an abnormal naming convention. Instead of NAMESPACE_MODULE it uses NAMESPACE_MODULE_SUBMODULE: $ find app/code/community -type f app/code/community/Acme/ModuleName/Bar/etc/...
3
votes
0answers
15 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
3
votes
1answer
79 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
21 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
3
votes
1answer
83 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
3
votes
1answer
420 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
3
votes
0answers
87 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
3
votes
1answer
184 views

Admin Security, Lockout Attempts, PW Resets

A recent article went out about improving admin security. In it they suggest setting the maximum PW resets and Lockout Time, and for Magento 1.x, this is supposed to live under System > Configuration ...
3
votes
0answers
120 views

Magento 1.9 A strange record found in customer table

I have noticed that there is a weird customer created in my admin, I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
3
votes
0answers
99 views

Removal of .orig files

In patching some Magento sites the patch leaves behind a .orig version of some of the files that were patched. I've been removing these from version control but was curious is there's any purpose to ...
3
votes
0answers
158 views

get.php in server logs - security issue?

I noticed multiple hits per day on get.php in the access logs of a Magento 1.14 store, resulting in PHP errors and a HTTP 500 response. Some of them have bot user agents like facebookexternalhit/1.1 (...
2
votes
0answers
112 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
2
votes
0answers
118 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
2
votes
1answer
4k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
2
votes
1answer
947 views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
2
votes
1answer
599 views

Restricting access to anonymous web APIs

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html By default magento 2 only restrict Catalog, Store and CMS API from anonymous users. In a ...
2
votes
1answer
267 views

“Blind SQL Injection” alert from one scanner for Magento site…legit?

I help manage a Magento site and one of the tools we use in our efforts to stay on top of site security is Decertify. I just ran a report & it came back with a warning about possible "blind SQL ...
2
votes
2answers
268 views

Contact form hack

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)...
1
vote
0answers
17 views

Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string

PHP 5.5.38 Magento 1.9.3.2 I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
1
vote
0answers
16 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
1
vote
0answers
102 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
1
vote
0answers
122 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
1
vote
0answers
59 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
1
vote
0answers
7 views

Creating custom 2FA provider

I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator). Anybody who can point me in the right direction? I have been working with ...
1
vote
1answer
30 views

Prevent Magento2 display information on script on homepage

I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
1
vote
2answers
220 views

Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient

I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
1
vote
0answers
39 views

New security threat to Magento caused by it using jQuery-File-Upload?

Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it. Is this an issue for Magento and should ...
1
vote
1answer
379 views

How to remove malicious code from the each files of the website magento 2?

I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website? Is any script to remove or replace this malicious code? ...
1
vote
2answers
154 views

I found some malicious code in all index.php of magento 1.9.2

Need help to stop malicious code in all index.php file Once I remove malicious code from index.php then again its apperar in index.php files malicious code like -- $swvJgN7="xQC+...
1
vote
2answers
123 views

Our Magento account was hacked; files deleted; hosting company is unable to restore

Magento 1.9.1 Porto theme Managed VPS from Hostforweb CentOS 7.x/WHM / Cpanel We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
1
vote
1answer
514 views

Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2

Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2 Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted ...
1
vote
0answers
225 views

Having issue with Magento 2 security scan. Magento Compromise Injection

I have checked with my all the sites with the bundle and merge js I am getting the same issue for all the sites i.e. Magento Compromise Injection. When I remove bundle and merge js then security scan ...
1
vote
0answers
142 views

magento 1.7.0.0 security patch SUPEE-10415 installation issue - Hunk #1 FAILED

Please help me to get rid of this problem and help me to install this SUPEE-10415 security patch on Magento 1.7.0.0.
1
vote
1answer
129 views

prevent multiple login : Magento 2

I want to prevent a customer to login multiple times from different machines. When a customer tries to login I want to logout customer logout from all other machines. How can I logout customer from ...
1
vote
1answer
103 views

Strange search terms

I have some strange search terms in my magento admin panel. It looks like 1 waitfor delay '0:0:3' -- or -1' OR 3 512-512-1=0 0 0 1 or '9WQxvY67'='. I've looked into my log and it seems to be a ...
1
vote
2answers
357 views

Ho can i install Patch on WAMP localhost

Localhost magento panel securty alert, Community Edition 1.9.X and SUPEE-**** Security Enhancements. The patch download and moved to root folder, run by sh patchname.sh Not working Getting error ...
1
vote
1answer
59 views

code added to core file being used to steal cc info

I'm curious, our client has been getting calls about users getting cc's stolen after being used on their site. After running multiple scans and checking at the server level the only thing I could ...
1
vote
0answers
45 views

The Shopping cart is being shared by visitors

I am having several serious problems on the site and I do not know what the reason may be. I looked at several topics and did not see who had the same problem. I am not an expert, I bought a template ...
1
vote
0answers
155 views

Preventing fraudulent credit card authorization attempts - carding

What are some solutions for preventing fraudulent credit card authorization attempts? Magento captcha no longer seems to do anything and attempts with several reCaptcha modules has not worked either. ...
1
vote
1answer
48 views

Free Shipping Calculation Problem, Possible Fraud Order, Exploit or Misconfiguration?

We have a rule setup to give free shipping on orders over $49. We had a very suspicious order come through where the discount didn't make sense: You can see in the screenshot the only coupon listed ...
1
vote
0answers
668 views

Implimenting a Content Security Policy Magento 1.9.x

I'm looking to improve the security of my site with a Content Security Policy. I have set one up for my site in htaccess (using Content-Security-Policy-Report-Only and doing everything possible to ...
1
vote
1answer
65 views

SUPEE8788 and Wishlist (view.phtml) file

When I was installing supee 8788, it threw a HUNK error on the following line app/design/frontend/base/default/template/wishlist/view1.phtml basically it was looking to modify view.phtml but in my ...
1
vote
1answer
77 views

How to properly secure my Magento 2 site?

I have my Mage2 site set up on an EC2 and use ssl access, plus a custom admin url and the permissions are all correct. However, I want to add .htaccess to my admin. What file do I need to add this too?...
1
vote
0answers
156 views

RSS security for admin data

Magento has a built in frontend rss feed for customer orders via /rss/sales/orders that is blocked via page auth which seems open to brute force attacks? Also if I was to use the same function for ...
1
vote
1answer
31 views

How secure is the Magento 2 File Uploader

I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is? I already ...
0
votes
1answer
45 views

Magento 2, Magento Unprotected XML

I have one Magneto 2.2.3 instance and when we check for security scan it is showing below error: We have determined that your Magento installation's configuration file(s) are publicly accessible over ...
0
votes
2answers
46 views

Magento 2, XSS Patch not detected (APPSEC-2143)

In Magento security scan I got the below message for my Magento instance: XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143) I am using Magento 2.2.3 How could I resolve this? Is ...
0
votes
0answers
26 views

Magento 2 factor authentication

Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9. This is the extension release ...
0
votes
0answers
16 views

Hideit input on other forms

I stumbled across hideit input on contact us form https://magento.stackexchange.com/a/107656/70343 Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
0
votes
0answers
23 views

Magento 2: Is there any site which is showing missing security patch?

Is there any website which is provide a report about missing security patch or which need to install ? I just need to install patch in magento 2.1.9.