Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
0
votes
1answer
842 views

Compare a md5 password to Magento salt.password

i'm facing an issue, some of you may help me find a clue ? i have password, that come from an external source. allready md5 applied on it $external_password_md5; what i'm trye to achieve is to ...
1
vote
2answers
238 views

Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient

I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
2
votes
1answer
344 views

Problem with patch SUPEE-10888 on Magento 1.9.0.1

Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed: Checking if patch can be applied/reverted successfully... ERROR: ...
3
votes
0answers
478 views

Security Patch SUPEE-10975 - Possible issues? [duplicate]

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10975 SUPEE-10975, Magento Commerce 1....
27
votes
4answers
27k views

How to escape output data?

Is there a built-in Magento helper to escape outputted template data to prevent XSS? Or should I just use the PHP htmlspecialchars or htmlentities functions?
1
vote
0answers
41 views

New security threat to Magento caused by it using jQuery-File-Upload?

Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it. Is this an issue for Magento and should ...
3
votes
2answers
1k views

Webgility RCE vulnerability

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility. While their tool is very helpful in scanning the site and asserting ...
21
votes
16answers
7k views

Security Patch SUPEE-10888 - Possible issues?

SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues. https://magento.com/security/patches/supee-10888 SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
0
votes
0answers
18 views

Why does /soap not follow site X-FRAME header?

After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
7
votes
2answers
152 views

What is the purpose / attack behind people doing covert automated customer registration?

We have recently observed people creating customer accounts automatically on Magento sites in bulk. Errors in their tools make it obvious that all the accounts they're creating are linked, such as ...
2
votes
1answer
73 views

How to stop fake reviews and fake signups on Magento 1 and Magento 2?

We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
1
vote
1answer
139 views

prevent multiple login : Magento 2

I want to prevent a customer to login multiple times from different machines. When a customer tries to login I want to logout customer logout from all other machines. How can I logout customer from ...
1
vote
1answer
1k views

Can / Should I Use The Admin Session in Frontend

For some use cases it would be nice to know, when on frontend, if an admin is logged in and to fetch the user's ACLs. I know that this is not "easily" possible, i.e. the frontend and admin sessions ...
29
votes
2answers
7k views

Magento 2: template security: which method to use?

I'm aware Magento 2 has several methods available to secure the template: $block->escapeHtml() $block->escapeQuote() $block->escapeUrl() $block->escapeXssInUrl() But I'm wondering when ...
1
vote
1answer
407 views

How to remove malicious code from the each files of the website magento 2?

I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website? Is any script to remove or replace this malicious code? ...
1
vote
2answers
191 views

Magento 1.9.3.2 - Exception printing is disabled by default for security reasons

I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error. I have ...
1
vote
2answers
184 views

I found some malicious code in all index.php of magento 1.9.2

Need help to stop malicious code in all index.php file Once I remove malicious code from index.php then again its apperar in index.php files malicious code like -- $swvJgN7="xQC+...
3
votes
1answer
86 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
1answer
227 views

Magento2 Two factor authentication for Frontend

Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
35 views

How to secure my website magento 2

I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so. Also i want advice from you concerning sécurity ...
2
votes
1answer
129 views

How to create a nonce / secure hash in Magento 2?

I want a simple link to activate a customer out of an email that gets sent to the admin on registration. I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
1
vote
0answers
20 views

Access orders page with wget [duplicate]

people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like wget -user myUserName -password myPassword ...
1
vote
1answer
81 views

Question Magento htaccess - FTP subfolder are reachable for everyone

I clean installed a new Magento shop and everything works fine. I only have a problem with the protection of the subfolders. For example i can type in the URL www.exampleshop.com/vendor this url is ...
4
votes
2answers
2k views

How to purge (delete) credit card numbers stored on Magento 1.9.1.0?

We used the 'Saved CC' payment method in our Magento 1.9.1.0 store and now we would like to delete the credit card numbers for security reasons. What is the easiest procedure to delete all credit ...
4
votes
1answer
189 views

Admin Security, Lockout Attempts, PW Resets

A recent article went out about improving admin security. In it they suggest setting the maximum PW resets and Lockout Time, and for Magento 1.x, this is supposed to live under System > Configuration ...
1
vote
0answers
78 views

Magento 2 CE + CyberSource Checkout [closed]

I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error. You are not authorized to view this page. The transaction has not been processed. If the problem ...
1
vote
1answer
63 views

Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?

Magento 1.9.1 Porto theme Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
0
votes
0answers
37 views

How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?

My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
1
vote
1answer
2k views

PayPal glitch or Hack? Payments went to a random address

I'm either looking at a hacking attempt or a temporary PayPal glitch here. We're with PayPal Australia using PayPal Express. We're on Magento CE 1.7.0.2. Luckily I had the PayPal Express module on ...
8
votes
6answers
7k views

Tools to Scan Magento Code for Malicious Content

We have a client who is very concerned with Malicious code being introduced in third party modules, especially modules that are coming from Magento Connect (Or any free module) They would like to use ...
4
votes
1answer
3k views

Magento 2: How to get registered customer IP

Anyone know how to determine registered customers IP? I have some spam registrations, so I have to block some IPs. If it's not available from M2 backend then by database table or something?
0
votes
1answer
90 views

The site ahead contains malware Attackers currently on magento

My Website is not working from 3 days boheco.org(magento version- 1.9.3.4)
3
votes
2answers
360 views

Malware Attack On Magento 1.9.2

My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url please help ...
2
votes
1answer
1k views

Using SVG logo in Magento 2.2.4

I am trying to upload an SVG logo for my Magento website, but it is not allowing me to upload an SVG file. It says that it is an unsupported file. Any idea how to resolve this? Based on internet ...
0
votes
1answer
923 views

Magento 1 end of life on Nov. 2018 or not?

Please see this answer by an internal staff of Magento who states that: Magento 1.x end of life is November 2018. However on their official blog, this post states: Magento 1 has been and will ...
0
votes
1answer
306 views

Hide Magento Admin Url from outside world

We have a magento server up and running. The server had the default 'admin' url which was then changed to some random string for security purpose, which only our team knows. Now we also have an admin ...
0
votes
1answer
148 views

Data Security has been compromised

In my Magento 1.9 store, some of the Customer's Default Billing name and Address has been amended. I first got to know this when one of my customer complained to me about their name that has been ...
1
vote
1answer
530 views

Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2

Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2 Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted ...
1
vote
1answer
514 views

Magento 2 : What's the best practice when it comes to escaping in templates?

This is a question about best practices when it comes to writing templates / block classes and security. When it comes to writing templates I know you need to escape everything that comes into the ...
2
votes
0answers
139 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
0
votes
1answer
325 views

What is the data encryption / hashing key management method used in Magento 2

Like in the title. What is the data encryption / hashing key management method used in Magento 2? I found this question Encryption Method Used by Magento Enterprise, however, is the same method used ...
22
votes
3answers
8k views

How did they find my custom admin URL?

I have a custom admin url, still I saw someone trying to login into admin. I even changed it, and shortly after the next login was tried. How could this happen, I thought its secure?
2
votes
1answer
88 views

I've just applied SUPEE-9767 to a Magento 1.6.2.0 site and there is no formkey option to enable. How has this happened and how can I fix it please?

I have applied the SUPEE-9767 patch for the correct version (1.6.2.0) of Magento and in the admin area, I can see the warning at the top of the page, indicating that the patch was successful. However,...
6
votes
4answers
765 views

How does MageReport determine if patch 9767 is installed?

I've applied patch 9767 but for some reason, MageReport is saying it is not installed. Does anyone know the specifics of how MageReport determines if this patch is installed? In my access logs, I can ...
3
votes
1answer
461 views

SUPEE-10266 and SUPEE-10348

I have a client's site that is currently using Mag 1.9.1.0 and need to apply the latest patches. I've applied both 10266 and 10336 (in that order) - all good. However on the description for 10226, it ...
108
votes
23answers
35k views

Security Patch SUPEE-9767 - Possible issues?

A new security patch is out for Magento 1, addressing 16 APPSEC issues: https://magento.com/security/patches/supee-9767 Seven of the vulnerabilities score 8.0 or higher for CVSSv3 Severity, and they ...
1
vote
2answers
276 views

Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts

I have been scanning the website at Magento Scan and getting the following error: Magento Compromise Injection Your site is compromised with injected JavaScript. (131) The malicious code ...
4
votes
0answers
124 views

Magento 1.9 A strange record found in customer table

I have noticed that there is a weird customer created in my admin, I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
50
votes
6answers
31k views

Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)

The Magento security patches look like they are .sh files, how would someone apply these patches without SSH access to their Magento installations? Also, are these patches cumulative? IE: Will they ...
7
votes
2answers
18k views

Admin menu path to: Enable Form Key Validation On Checkout

After installing patch SUPEE-9767 the "Enable Form Key Validation On Checkout" warning appeared and from the link provided in that warning I was able to enable Form Key Validation. But, after having ...