Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
8
votes
6answers
5k views

How to check if Magento patch has been installed?

So I just installed recent critical patches SUPEE-5994 + SUPEE-5344 + SUPEE-1533 - through SSH on my server. I did the following steps for installing each patch: Downloaded the patches from: https://...
8
votes
5answers
9k views

How to apply the Magento 2 patches?

I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch. How can I apply the *.patch files?
8
votes
1answer
4k views

Why does Magento POST to its own /app/etc/local.xml?

It seems to be initiated at admin operations, such as catalog save/edit. As seen in the logs. The client IP for the POST is the server's internal IP. 302 2014-08-30T06:43:40+00:00 POST /index.php/...
8
votes
6answers
7k views

Tools to Scan Magento Code for Malicious Content

We have a client who is very concerned with Malicious code being introduced in third party modules, especially modules that are coming from Magento Connect (Or any free module) They would like to use ...
8
votes
2answers
1k views

Using different escaping methods

I noticed class vendor/magento/framework/Escaper.php which contains a few useful security methods used inside (mainly) templates. Some of them are quite common (escapeHtml()), but some of them are ...
8
votes
1answer
4k views

Is magento http/https secure or should the entire website be forced to use https?

I'm setting up a magento website but one thing i've noticed is https can be used only for secure content such as login pages and account details etc. This means on product pages regular http is used. ...
8
votes
2answers
2k views

How to check applied patches in magento 2

Is there a way in Magento 2 to check the applied patch status? Just like we can check the patch status in Magereport in Magento 1?
7
votes
6answers
6k views

Check my Magento security status

I just had trouble to install the SUPEE-1533 and SUPEE-5344 on CE 1.7.0.0. I did it through the FTP method from Magentary. Question is then : how can I make sure that my Magento install got all ...
7
votes
2answers
3k views

Admin routing compatibility mode for extensions: Enable or Disable?

I have just updatet my store to the latest Magento CE 1.9.2.2 software version (not the Patch SUPEE-6788, I did the full core update using the Magento Downloader). After the update I went to System &...
7
votes
4answers
6k views

Hacked magento site 1.9.2.4

We got a hacked Magento website that is on update 1.9.2.4. The files that are hacked are: api.php indexs.php: hackscript postfix.php: hackscript skin/adminhtml/default/default/filesystem/css/loader....
7
votes
2answers
18k views

Admin menu path to: Enable Form Key Validation On Checkout

After installing patch SUPEE-9767 the "Enable Form Key Validation On Checkout" warning appeared and from the link provided in that warning I was able to enable Form Key Validation. But, after having ...
7
votes
1answer
1k views

What is the form_key used for?

I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence. Everyone just worked ...
7
votes
1answer
7k views

How to check what suppee patches have been installed on Magento [duplicate]

I'm about to start working on a Magento website and with the two security patches released yesterday (SUPEE-7405 & SUPEE-7616) I would like to ensure that all other security patches were installed ...
7
votes
4answers
2k views

Credit Card Hijack malicious javascript code continuously insert by someone in my site under HTML Head -> Miscellaneous Scripts

Someone continuously inserts Credit Card Hijack malicious javascript into to my site under system->configuration->General->Design->HTML Head->Miscellaneous Scripts. Note: I changed every thing ...
7
votes
2answers
3k views

Undefined index: form_key in … downloader/Maged/Model/Session.php on line 252

After applying patch SUPEE-6285 on Magento 1.9.1.0, I am seeing the following error in system.log several times a day: Undefined index: form_key in ... downloader/Maged/Model/Session.php on line ...
7
votes
4answers
2k views

Upgrading compromised Magento from 1.7 to 1.9

I've been doing some research but there appears to be multiple solutions, and I want to get it right. I need to upgrade my Magento from 1.7.0.2 to the latest (1.9) being that our server was ...
7
votes
4answers
629 views

ZEND FRAMEWORK 1 SECURITY - Email Settings?

I have a question on the new Zend security vulnerability announced by Magento recently regarding the email settings in System-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-...
7
votes
1answer
1k views

What permissions schema should I use when deploying Magento securely?

We run what I feel is pretty standard Magento setup: Deployed via rsync (it should also be deployable with git pull and scp/SFTP for simpler server configurations and to make developers' lives easier....
7
votes
1answer
1k views

password protection

these days I have deployed a magento instance, but the webshop is not online yet, so I have added an .htaccess password protection to the website which indeed worked fine, but caused problems when my ...
7
votes
2answers
152 views

What is the purpose / attack behind people doing covert automated customer registration?

We have recently observed people creating customer accounts automatically on Magento sites in bulk. Errors in their tools make it obvious that all the accounts they're creating are linked, such as ...
6
votes
3answers
5k views

Magento Security Patch SUPEE-5994, how do I verify installation?

After installing security patch SUPEE-5994, how do I verify whether patch is installed successfully. Will the test at http://magento.com/security-patch find out if the patch is installed?
6
votes
4answers
1k views

Does Magento 1.4.1.1 require patch SUPEE-6788?

I am using Magento 1.4.1.1 and I received a message: "New Magento Security Patch (SUPEE-6788) – Install Immediately" but I could not find patch SUPEE-6788 for Magento 1.4.1.1. Is it required to ...
6
votes
4answers
738 views

How does MageReport determine if patch 9767 is installed?

I've applied patch 9767 but for some reason, MageReport is saying it is not installed. Does anyone know the specifics of how MageReport determines if this patch is installed? In my access logs, I can ...
6
votes
1answer
8k views

Error while Patching Security Patch (SUPEE-6285)

While trying to patch magento, which I have done a few times now with prior patches successfully, I encountered an issue with this latest patch. Checking if patch can be applied/reverted successfully....
6
votes
4answers
836 views

Magento Security Scan not able to verify site

I am trying magento's New Magento Security Tool with below url https://account.magento.com/scanner/index/form/ But i can not Verify Site Ownership, every time when i click on Verify Confirmation ...
6
votes
2answers
1k views

remove unsecure content from modals-wrapper

Out of the box Magento 2 adds <div class="modal-content" data-role="content"> div at the end of the code. I am not sure what it is supposed to do. But it contains a login form with password ...
6
votes
2answers
811 views

What's the “NEW ZEND FRAMEWORK 1 SECURITY VULNERABILITY”?

Today we learned that Magento has a new vulnerability. They call it NEW ZEND FRAMEWORK 1 SECURITY VULNERABILITY. It's described as follow here: To protect your site from this vulnerability, you ...
6
votes
1answer
2k views

Recommended File System Ownership and Privileges

I need help for recommended privileges on my dedicated server. My dedicated server is installed with Debian and on the official documentation of Magento it's recommended to follow the following ...
6
votes
3answers
3k views

Is there a generic way I can apply input filtering to Magento form processing?

In checking my Magento-powered site for XSS, I've found a couple of problem forms in our custom code, that let users submit arbitrary HTML and script tags that we dutifully inject into our site. (...
6
votes
1answer
385 views

What is new in SUPEE 8788 v2?

As we all know, there is some issue in security patch SUPEE 8788, so magento has released its new security patch SUPEE 8788 v2. I am wondering there is anything new for the after magento 1.8 or it is ...
6
votes
3answers
360 views

Temporary switching to admin store

A client wanted to move products to a different category when sold out so I quickly created an observer but it failed to save the product since frontend wasn't allowed to modifiy the products. By ...
6
votes
1answer
80 views

Updating Security Patches

I have two questions: When you apply the latest security patch, does it patch up previous vulnerabilities? For example, if I patch my site with SUPEE-5994 do I still have to patch it with SUPEE-5344 ...
6
votes
1answer
189 views

Critical Vulnerability in Magestore Store Locator extension [closed]

Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension There's been no patch released by the actual vendor - Magestore Does anyone know: What the ...
6
votes
1answer
241 views

Using the secret admin frontname in a new adminhtml router

I have a module that uses an abnormal naming convention. Instead of NAMESPACE_MODULE it uses NAMESPACE_MODULE_SUBMODULE: $ find app/code/community -type f app/code/community/Acme/ModuleName/Bar/etc/...
5
votes
5answers
1k views

Magento Hacked: displays list of user emails and error message

-My client suspects his site was hacked,I'm not sure, but when I open index.php I get a list of emails and usernames, and what appears to be encrypted passwords (please correct me if I'm wrong). I ...
5
votes
1answer
163 views

Unknown class Mage_Cms_Auth_xaj found in ../Cms/controllers/IndexController.php - malicious or just bad form?

I was asked to give some advice on a 1.9.0.1 instance which has had none of the recent SUPEEs installed. SUPEE-1533 went in with no problem, but SUPEE-5344 failed, with a message of patching file ...
5
votes
2answers
3k views

Not able to apply security patch SUPEE-6285

We have a Magento website having version 1.9.1.0 (CE). As I got the update from Magento support, to apply security patch on your store to prevent from security threat. We have downloaded the secutiry ...
5
votes
3answers
755 views

Security Patch (SUPEE-6285) – Install Immediately In Magento 1.9.0.1

How To Resolve New Magento Security Patch (SUPEE-6285) – Install Immediately In Magento 1.9.0.1 please find the below image I have tried this code passthru("/bin/bash PATCH_SUPEE-6285_CE_1.9.1.1_v2-...
5
votes
1answer
466 views

Is Magento based on 3 tier architecture?

I want to know few things: Is magento based on 3 tier architecture? Is it free from SQL-Injection, cross-site-scripting, CRLF injection attacks and SSI attacks?
5
votes
3answers
2k views

Magento 2: When/Why to do customer:hash:upgrade?

When I run below command, it gives below output. $ php bin/magento customer:hash:upgrade . Finished What actually this command do? When I have to run this command? What changes it will do? Will ...
5
votes
1answer
132 views

Security: Patched 1.7.0.2 versus 1.9.2.2

I have three sites running 1.7.0.2 all fully patched and updated. Modules all written the 'proper' way (with a couple of small exceptions). The sites are all pretty much clones of each other. ...
5
votes
4answers
4k views

Magento 1.9.1.0 patch SUPEE-6788 1 out of 1 hunk ignored missing .htaccess.sample

I am using Magento 1.9.1.0 and tried to install the new patch SUPEE-6788 through SSH but getting ERROR below. I am not able to understand what's wrong and where exactly the error lies I have ...
5
votes
1answer
466 views

What files/folder do not belong on production?

Some community members suggest that folders like downloader and dev don't belong on a production environment. Is there an official list somewhere? What else has no place on the production server?
5
votes
2answers
476 views

Is there a method how I can check the security of magento store?

is there a way to check whether Magento store is secured or not just by entering the URL of the store
5
votes
1answer
1k views

Magento 2 - SQL Injection

How to avoid sql injection when running a native sql query with parameter input? e.g. $sql = "Select * from eav_attribute where attribute_id = {$attribute_id} "; $result = $this->_connection->...
5
votes
1answer
13k views

Getting “access forbidden by rule” error at magento in nginx server /app/etc/local.xml

I am getting this error for my website which is built on magento-1.9.0. 2015/07/13 05:50:44 [error] 1371#0: *491517 access forbidden by rule, client: **.***.***.***, server: www.example.com, request: ...
5
votes
1answer
584 views

What to do if my Magento website is affected by Cloudflare's #Cloudbleed traffic leak

As some of you may know, a Cloudflare vulnerability has been released yesterday. From what I understood, a lot of websites have been affected because they hosted JS libraries on their CDNs. Some ...
5
votes
1answer
165 views

n98-magerun.phar Security Best Practice

I have recently inherited a Magento site that has n98-magerun.phar sitting, publicly accessibly, on the site's home directory. I know that this is a command line tool, but I wonder if it should be ...
5
votes
3answers
2k views

New security patch SUPEE-6482

Just wanted to make sure! I am running CE 1.9.1.1 and my latest update was PATCH_SUPEE-6285_CE_1.9.1.1_v2-2015-07-08-08-07-43. Was this the latest security patch for 1.9.1.1? Is the new security ...
5
votes
1answer
168 views

Is New Magento Security Patch required on fresh install?

I installed Magento today with: wget http://www.magentocommerce.com/downloads/assets/1.9.1.1/magento-1.9.1.1.tar.gz I thought as this is the latest version I would not need to install the security ...