Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Denotes security questions on Magento.

6
votes
1answer
240 views

Using the secret admin frontname in a new adminhtml router

I have a module that uses an abnormal naming convention. Instead of NAMESPACE_MODULE it uses NAMESPACE_MODULE_SUBMODULE: $ find app/code/community -type f app/code/community/Acme/ModuleName/Bar/etc/...
3
votes
1answer
58 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
20 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
3
votes
1answer
76 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
3
votes
1answer
332 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
3
votes
1answer
163 views

Admin Security, Lockout Attempts, PW Resets

A recent article went out about improving admin security. In it they suggest setting the maximum PW resets and Lockout Time, and for Magento 1.x, this is supposed to live under System > Configuration ...
2
votes
1answer
4k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
2
votes
1answer
834 views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
2
votes
1answer
261 views

“Blind SQL Injection” alert from one scanner for Magento site…legit?

I help manage a Magento site and one of the tools we use in our efforts to stay on top of site security is Decertify. I just ran a report & it came back with a warning about possible "blind SQL ...
1
vote
1answer
29 views

Prevent Magento2 display information on script on homepage

I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
1
vote
1answer
335 views

How to remove malicious code from the each files of the website magento 2?

I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website? Is any script to remove or replace this malicious code? ...
1
vote
1answer
498 views

Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2

Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2 Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted ...
1
vote
1answer
118 views

prevent multiple login : Magento 2

I want to prevent a customer to login multiple times from different machines. When a customer tries to login I want to logout customer logout from all other machines. How can I logout customer from ...
1
vote
1answer
95 views

Strange search terms

I have some strange search terms in my magento admin panel. It looks like 1 waitfor delay '0:0:3' -- or -1' OR 3 512-512-1=0 0 0 1 or '9WQxvY67'='. I've looked into my log and it seems to be a ...
1
vote
1answer
561 views

Restricting access to anonymous web APIs

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html By default magento 2 only restrict Catalog, Store and CMS API from anonymous users. In a ...
3
votes
0answers
82 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
3
votes
0answers
114 views

Magento 1.9 A strange record found in customer table

I have noticed that there is a weird customer created in my admin, I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
3
votes
0answers
94 views

Removal of .orig files

In patching some Magento sites the patch leaves behind a .orig version of some of the files that were patched. I've been removing these from version control but was curious is there's any purpose to ...
3
votes
0answers
156 views

get.php in server logs - security issue?

I noticed multiple hits per day on get.php in the access logs of a Magento 1.14 store, resulting in PHP errors and a HTTP 500 response. Some of them have bot user agents like facebookexternalhit/1.1 (...
2
votes
0answers
105 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
1
vote
0answers
100 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
1
vote
0answers
122 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
1
vote
0answers
65 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
1
vote
0answers
46 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
1
vote
0answers
7 views

Creating custom 2FA provider

I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator). Anybody who can point me in the right direction? I have been working with ...
1
vote
0answers
36 views

New security threat to Magento caused by it using jQuery-File-Upload?

Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it. Is this an issue for Magento and should ...
1
vote
0answers
213 views

Having issue with Magento 2 security scan. Magento Compromise Injection

I have checked with my all the sites with the bundle and merge js I am getting the same issue for all the sites i.e. Magento Compromise Injection. When I remove bundle and merge js then security scan ...
1
vote
0answers
138 views

magento 1.7.0.0 security patch SUPEE-10415 installation issue - Hunk #1 FAILED

Please help me to get rid of this problem and help me to install this SUPEE-10415 security patch on Magento 1.7.0.0.
1
vote
0answers
44 views

The Shopping cart is being shared by visitors

I am having several serious problems on the site and I do not know what the reason may be. I looked at several topics and did not see who had the same problem. I am not an expert, I bought a template ...
1
vote
0answers
144 views

Preventing fraudulent credit card authorization attempts - carding

What are some solutions for preventing fraudulent credit card authorization attempts? Magento captcha no longer seems to do anything and attempts with several reCaptcha modules has not worked either. ...
1
vote
0answers
625 views

Implimenting a Content Security Policy Magento 1.9.x

I'm looking to improve the security of my site with a Content Security Policy. I have set one up for my site in htaccess (using Content-Security-Policy-Report-Only and doing everything possible to ...
1
vote
0answers
154 views

RSS security for admin data

Magento has a built in frontend rss feed for customer orders via /rss/sales/orders that is blocked via page auth which seems open to brute force attacks? Also if I was to use the same function for ...
0
votes
0answers
11 views

Issues on blocking magento website

Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it. Also no one blocked my website in the office. Still i am not able to open it in the office ...
0
votes
0answers
9 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
0answers
21 views

Do I need to update to 2.3.1?

If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
0
votes
0answers
37 views

Security problem: newsletter/subscribe has not been whitelisted

i have just move the my magento store to new hosting then im facing this issue In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
0
votes
0answers
18 views

Magento1 website Security patch installation by script then error show

Magento1 website Security patch installation by script and when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show: ERROR: "/app/etc/" must exist for proper ...
0
votes
0answers
18 views

Security steps and permission to have for Magento2

I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
0
votes
0answers
20 views

Magento 2.2.2 - Restrict access to Admin and redirect to 404 if unautohrized

I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access http://store.com/admin. Could think of ...
0
votes
0answers
19 views

ASV scan failing because of Session ID in URL

We're on a Magento 1.9.3.7 and our Aperia ASV scan is failing because of Session ID in URL. One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384 Payload:...
0
votes
0answers
17 views

Why does /soap not follow site X-FRAME header?

After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
0
votes
0answers
34 views

How to secure my website magento 2

I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so. Also i want advice from you concerning sécurity ...
0
votes
0answers
35 views

How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?

My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
0
votes
0answers
187 views

Magento 2 - Security : HTTP Only cookie

Our Security team raised security issue cookie setting and asked to set HTTP only and Secure cookie. Looks like Magento functionality overrides HTTP only parameter. To fix this issue we have set ...
0
votes
0answers
45 views

Magento 1.9.1 error while security patches SUPEE-3941

When I am trying to install any patches it will give me error like below, ERROR: Patch can't be applied/reverted successfully. patching file downloader/Maged/Model/Connect.php Hunk #1 FAILED at 486. ...
0
votes
0answers
19 views

How to restrict magento rest API,it is only accessible by https?

I want to access API with HTTPS only.If anyone access my API with HTTP,it does not work.How can achieve it?
0
votes
0answers
33 views

Mganto1.9 : Item (Mage_Sales_Model_Order) with same id already exist

After I migrate my Magento shop from one hosting provider to another one I have a big problem. When I want to go in back to administration into sales->order I get an error There has been an ...
0
votes
0answers
29 views

Why is customer/section/* accessible publicly? Can we hide this?

I am relatively new to Magento 2. I have created a store and ran security scan and noticed I have the following: URL: https://www.mystore.com/customer/section/load/install/ or https://www.mystore.com/...
0
votes
0answers
221 views

Magento 2:User Permission via API Rest

I have a multi-store magento 2 installation where the stores are totally independent, from different companies. So, we have an integration with our ERP system in the company. Each user in our system ...
0
votes
0answers
95 views

SUPEE-1533, SUPEE-5344 Possible Problems?

I tried to install patches Magento SUPEE-1533, SUPEE-5344 CE 1.8.1 without ssh access direct file upload but after install there's error both backend and website became unaccesable so i replaced all ...