Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Magento 2.2 - Mage-Report Exposed Magento 2 API

Magento 2.2.3 I have scan the website in Mage Report, How to solve Exposed Api issue. What magento2 patch for this instead to upgrade version.
0
votes
1answer
16 views

Payment Failed Emails M 2.3.5 - Not working for us

We are currently using Magento 2.3.5 From my understanding, payment failed emails are sent when a transaction fails. By fails I hope that this means it is declined or voided by the payment method. ...
1
vote
0answers
20 views

prevent brute force attacks on the discount codes

Is there a way to prevent brute force attacks on the discount code input eg limit the number of discount codes a customer can enter a day?
0
votes
0answers
17 views

How to prevent Host Header Poisoning in Magento 2?

I'm using magento 2.4.1 , i tried to make a GET request, i added ':22345' as suffix in my host header so it will look like this: when I invoke this code in phtml file echo $block->getRequest()->...
0
votes
0answers
91 views

Magento 2: How to prevent duplicate form_key cookie?

I'm using Magento 2.4.1 version and I'm doing some security testing, one of the vulnerable results is the cookie form_cookie is being set twice in the HTTP response like this: Set-Cookie: form_key=...
0
votes
1answer
40 views

Script injection below body tag in Magento 2.4.1

I upgraded our Magento from 1.9 to 2.4.1 after we found malware that was trying copy customer credit cards before allowing the customer to use PayPal. I used Magento's migration tools to copy data to ...
1
vote
0answers
27 views

“Catalog Search index process unknown error:” 403 Forbidden

My System info: Apache2 /php7.4(mod-security, mod_proxy) /Mysql8 /Elastic7.10 After a fresh installation of M2.4 and configure it for the E7 with Apache proxy port 8080 to 9200. When I tried to run ...
0
votes
0answers
14 views

How to prevent directory traversals attacks when uploading a file?

I think it is the same as a normal php page, but, exists a specific way in Magento2 to prevent directory traversals attacks when uploading a file?
1
vote
1answer
42 views

Is the Magento 2 file system allowed to be owned by www-data? + Permissions question

I work at a company where I noticed that most of our Magento 2 file system is owned by www-data and in the www-data group on our Ubuntu server.Furthermore, the docroot directory /var/www/<...
0
votes
0answers
26 views

XS Vulnerability - Failed.XSS Patch not detected (APPSEC-1716) - How to fix?

Apply the Magento 2.2.5/2.1.14 Security Update immediately. Review your site for signs of compromise. Find more information about Security Best Practices. This issue is reported in a security report ...
0
votes
0answers
24 views

Magento 2 API Drop ship permissions

As a vendor, I am preparing to potentially link my store to offer dropship to another website (they take orders, I do fulfilment and processing on Magento 2), and create an API for this via Magento 2 (...
0
votes
0answers
23 views

Is this hack script?

I get this script in my site: <script type="text/javascript" xml="space">// <![CDATA[ (function(){var po=document.createElement("script");po.type="text/...
0
votes
1answer
69 views

How to check Magento Cloud patches available?

My Magento 2.3 Cloud is not updated, and I see some issues that when I reporting to Magento they send me a patch already released. Is there a way to see the list of patches available?
0
votes
0answers
53 views

How to set “Secure flag and HttpOnly Flag” on all magento cookies?

I am seeing many of the cookies that do not have the secure & http only flag set on it. ; http://php.net/session.cookie-secure session.cookie_secure = true ; http://php.net/session.cookie-...
0
votes
1answer
52 views

How to fix XSS in website in url ? Magento 1

I can see that browsing url like this https://www.anywebsite.com/?p=%3Cscript%3Ealert(document.cookie)%3C/script%3E shows alert into browser window. Is their any way to prevent it ? its XSS.
0
votes
0answers
11 views

Category/search images not showing in Firefox

I get Content Security Policy errors in Firefox. I have a CSP module that handles this just fine in Chrome, but this remains an issue in Firefox. Are there more steps that have to be taken to make ...
0
votes
0answers
50 views

The search term shows SQL injection in magento 1.9

I have found below search term on my magento 1.9's admin panel: epoxy) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL-- QBrO ../../../../../../../../etc/passwd AND 1=2 UNION SELECT ...
0
votes
1answer
44 views

Phishing Attack - Magento 1.9 - Too many Get method request for customer login page - Site Down

The IP : 167.172.230.190 hit my customer login page too many hits makes my server down Screenshot : https://snipboard.io/kde4fw.jpg Notes : Custom login page captcha enabled, added that IP in IP ...
0
votes
0answers
18 views

Magento Public Honeypot blacklist for LFD (or other firewall)

Several projects exist where malicious IP's are recorded or stored (DOS attacks, spam attack, brute force) ... and I was wondering if the Magento community also has 1 shared list of IPs specifically ...
1
vote
1answer
540 views

Two-Factor Authentication Invalid in Magento 2 admin panel

My client enabled 2FA (Two-Factor Authentication) in the Magento 2 admin panel, but every time that I scan the code to have it configured in my Google Authenticator and try to enter the code, it's ...
0
votes
0answers
14 views

M2 Session Cookie “Secure” when only serving https

A security researcher pointed out to us that the session cookie PHPSESSID does not have the secure attribute. Looking around in magento admin panel I could not find the option to change that and ...
0
votes
0answers
81 views

How to implement Google Recaptcha in Custom Form?

In Magento 2.3 we are allowed to implement Google Recaptcha as described in the following link https://docs.magento.com/user-guide/v2.3/stores/security-google-recaptcha.html How can I add the same ...
0
votes
1answer
19 views

Basic Auth / Restricting backend admin panel for M1

Good evening. Should it not be possible toeither restrict or use basic auth on the admin panel for login? Just as an extra security layer. Can there be any flaws/errors regadring 3rd party extentions ...
0
votes
0answers
151 views

Is rest/default/V1/guest-carts/ vulnerable?

I'm running M2.3.5. Every so often I'll get a small batch of errors from IPs outside my country (all US). I'm getting notifications in the form of Store Debug Errors. Here's an example: URL: https://...
2
votes
1answer
340 views

Magento 2 module to log failed login attempts, for Fail2ban

I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily. E.g. for every failed login attempt, the module would add a line ...
1
vote
0answers
29 views

Magento 2 - How to apply security patch?

In Magento 2 after a security report. I have this action to perform : Apply the Magento 2.2.7/2.1.16 Security Update immediately. Review your site for signs of compromise. Find more information about ...
5
votes
1answer
661 views

Sanitizing HTML output in templates in 2.4

Before 2.4 the way you could sanitize an html value in a template was to use $block->escapeHtml($valueHere);. Where $blick is the instance of the current block. This still works in 2.4, but the ...
0
votes
0answers
11 views

magento1 security patch issue

When run the security scan with base url. example: www.testurl.com all patchs are updated when run add the store code to base url example: www.testurl.com/us 10415 patch is failed can I know the ...
0
votes
1answer
72 views

Magento 2 and SELinux

So it turned out that SELinux is causing all the issues I've been having with USPS shipping calculation and Paypal redirecting. This is my current stack: 2.3.5p1 CentOS 8 PHP 7.3.18 Apache/2.4.37 ...
0
votes
0answers
11 views

How to apply a patch on plugins on Magento 1?

I should be applying security patches on a Magento 1 with several modules/plugins. In addition to the files in /local/Mage, I should also apply the patch to plugins that extend the classes of the ...
0
votes
0answers
24 views

Magento 1.9 and 2.3 admin details scrape attempts

I'm not sure if this is the best place for this post... I checked around and it didn't seem like there was anywhere else to post it. I just upgraded from Mage 1.9 to 2.3. In the last few months I ...
0
votes
0answers
19 views

Why is admin user's password stored in two tables?

The password of an admin user is stored in table admin_user (column password) and admin_password (column password_hash). What is the reason for storing it twice? I don't understand why it is ...
1
vote
0answers
17 views

5 malicious files found in Magento with a malware scan - are they for real or false positive?

Magento 1.9.x Softaculous installer in Cpanel A malware scan on our server has detected the following 5 malicious files - are these really problematic or could these just be false positives? /home/...
0
votes
2answers
190 views

Why is BitDefender flagging Magento 1 sites as containing malware

I'm not sure if this is the right place to ask this question, so apologies in advance. I've just noticed that several Magento 1 sites I look after including development sites are now being blocked by ...
0
votes
0answers
55 views

SUPEE-11314v2: Potential Issues? [duplicate]

Magento released SUPEE-11314 on Apr 28, followed by an updated version SUPEE-11314v2 on May 12. They mention you should revert 11314, if you already applied it, before installing v2. Description of ...
0
votes
1answer
23 views

Static content deploy generate thousands of weird folder names

i've run setup:static-content:deploy -f and now i'm getting a lot of strange folders on my pub/static/frontend folder For example one folder has the name "G7oLVFdw'; waitfor delay '0:0:6' -- " This ...
13
votes
9answers
14k views

Magento 2.3.5-p1 CSP font-src self unsafe-inline

In regarding to CSP I create own csp_whitelist, but still I am getting: The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag....
2
votes
4answers
6k views

How can I fix “Refused to load the stylesheet because it violates the following Content” in Magento 2.3.5

I've recently upgraded to Magento 2.3.5 and I've been encountering an issue with my Content Security Policy when trying to load a style sheet. The error (Chrome dev console): I've added maxcdn to ...
3
votes
1answer
6k views

Magento 2.3.5 Content Security Policy directive: "img-src

Upgrade to 2.3.5 and now getting this error bellow thought out the site on every page: [Report Only] Refused to load the image 'blob:http://my.domayn.com/axxxxxxxxxxxx' because it violates the ...
8
votes
10answers
5k views

Security Patch SUPEE-11314 - Possible problems?

Magento have released new Magento 1 versions 1.14.4.5 1.9.4.5 The patch number is SUPEE-11314 and is available at https://magento.com/tech-resources/download A summary (covering both M1 and M2 so ...
0
votes
0answers
27 views

How to install magento patch on old version

I have a 2.3.1 magento and i want to install the last security patch from 2.3.5. Can your confirm me that i have to install a least the 2.3.4 magento version before ? I am confused beceause With ...
0
votes
0answers
264 views

Magento 2 Security Patches Tracking

I need to understand this new Magento 2 patches. So I see that security patches are released as 2.3.3-p1. Let's say my version is Magento 2.3.2. And Magento has released 2.3.2-p1, 2.3.3-p1, 2.3.4-p1,...
2
votes
0answers
356 views

Implementing Google reCaptcha v.2 with Gene_Braintree module

Magento version EE 2.3.3-p1. I was wondering if anyone out there has implemented core Msp_Recaptcha at checkout when using the BrainTree or Gene_BrainTree modules. We've been hit HARD by carding ...
1
vote
1answer
73 views

What's security-only patch release and how to apply it?

I noticed we have security-only patch releases, what's it and how to use it? An example of these security-only patch releases, instead of having Magento 2.3.2 my client has installed Magento 2.3.3-p1....
0
votes
0answers
68 views

Wrong URL for category image when root is set to pub directory

I want to use pub/ directory for security reasons as document root for Magento website but when i switch it, images for categories and for manufacturers (in product detail) are not displayed. I ...
1
vote
1answer
96 views

Magento 2 Outdated JS Libraries - Failed. Outdated AngularJS library found Issue

We are using magento ver 2.2.4 and after run magento security scan tool, In generated report we found following error:- Outdated JS Libraries - Failed.Outdated AngularJS library found, response ...
1
vote
1answer
115 views

Profiler is enabled after a maintenance flag is created - malware?

It seems like the profiler on my site is automatically enabled after the site goes down in maintenance mode- Is there any reason why magento goes into maintenance mode and subsequently, the profiler ...
0
votes
0answers
185 views

Security Error - Bug Shooting return Data has been tampered error in Success page?

Magento 1.9 - Using Bug Shooting if i try to place an order i am getting response regard Data has been tampered. How to solve this security issue?
0
votes
0answers
383 views

magento 2 how to secure Cookie mage-cache-sessid and enable Secured Flag

Here Am trying to enable HttpOnly and Secured Flag for Cookies mage-cache-sessid or my domain. I did configuration in admin Panel >> store >> configuration >> general >> web but still flags not ...
2
votes
0answers
694 views

How upcoming SameSite cookie changes could affect Magento or 3rd modules, possible issues?

On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies. The ...

1
2 3 4 5
13