Slashdot Mirror

← Back to Stories (view on slashdot.org)

Critical Zen Cart Vulnerability Could Spell Black Friday Disaster For Shoppers (htbridge.com)

Posted by samzenpus on from the protect-ya-neck dept.

Mark Wilson writes: It's around this time of year, with Black Friday looming and Christmas just around the corner, that online sales boom. Today security firm High-Tech Bridge has issued a warning to retailers and shoppers about a critical vulnerability in the popular Zen Cart shopping management system. High-Tech Bridge has provided Zen Cart with full details of the security flaw which could allow remote attackers to infiltrate web servers and gain access to customer data. Servers running Zen Cart are also at risk of malware, meaning that hundreds of thousands of ecommerce sites pose a potential danger. Technical details of the vulnerability are not yet being made public, but having notified Zen Cart of the issue High-Tech Bridge says the date of full public disclosure is 16 December.

59 comments

  1. Further proof the web model blows by Anonymous Coward · · Score: -1

    All I keep seeing day in and day out are how buggy the crap you webchumps make is and the frameworks you use too. Nearly every single day the news shows it.

    1. Re:Further proof the web model blows by ooshna · · Score: 1

      And yet you continue to use the web...

    2. Re:Further proof the web model blows by Anonymous Coward · · Score: -1

      web model is fine; on the other hand php sucks.

    3. Re: Further proof the web model blows by Anonymous Coward · · Score: 0

      OK, I'll bite. What do you consider to be better than php?

    4. Re: Further proof the web model blows by TechyImmigrant · · Score: 1

      OK, I'll bite. What do you consider to be better than php?

      I coded the payment system on our store's website in python CGI scripts. Keep it simple first. It helps that I'm a crypto security type engineer for a big techy company in my day job, so it's not a challenge to bake in defense in depth. It sucks when PCI-DSS scans ding you for insecure versions after their probe finds my honeypot.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    5. Re: Further proof the web model blows by Anonymous Coward · · Score: 0

      Defense in depth is, by definition, not simply "baked in". Don't kid yourself, what you did was only once piece of a very large puzzle.

      Honeypots on a network with software that is running on the network is a vulnerability. Differing versions of the same software on a network can lead to leapfrogging, reflection, and worse. Imagine if someone knows full well it's a honeypot (outdated and new version on same network gives that away) they could compromise the honeypot, mimic the production server, then DOS the rest, email alerts and all. Then all your processing information is out the door.

      The people that "dinged" you for your theatrics were right in doing so.

    6. Re: Further proof the web model blows by John+Da'+Baddest · · Score: 1

      Too many assumptions here. Presumably the honeypot is full of false data delivering nonsense alerts to nowhere, and the owner is aware when it's compromised. That's what it's for. Of course, if you assume that hackers take over your entire data center at all 7 OSI layers, it really doesn't matter what defenses you have in place.

    7. Re: Further proof the web model blows by TechyImmigrant · · Score: 1

      The honeypot is a simple way to identify an attack source. It's only one thing. As for any defense-in-depth structure, the failure of one thing doesn't compromise the whole. Preferably the failure of several things doesn't compromise the whole.

      If you think there is anything to do with security in the PCI-DSS specs, you are sadly mistaken. They are a pile of poo.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    8. Re: Further proof the web model blows by JustAnotherOldGuy · · Score: 2

      I coded the payment system on our store's website in python CGI scripts.

      You can write secure code or insecure code in any language. You haven't shown anything that proves PHP itself is less secure than Python or Perl or ASP or $favorite_language.

      I've written hundreds of thousands of lines of PHP and I put security as my primary concern. None of them have been hacked because I rigorously sanitize data and don't allow users to access things they shouldn't. Yes, it's a bit of a pain to try and cover every conceivable attack vector, but you can write secure code in PHP just as you can in any language. It's not the language, it's the implementation of the code you write.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    9. Re: Further proof the web model blows by Anonymous Coward · · Score: 0

      Anything that doesn't actively encourage SQL injection attacks.

      If you have to know the inner workings of a language API to avoid SQL injection attacks, it's crap.

    10. Re: Further proof the web model blows by TechyImmigrant · · Score: 1

      I coded the payment system on our store's website in python CGI scripts.

      You can write secure code or insecure code in any language. You haven't shown anything that proves PHP itself is less secure than Python or Perl or ASP or $favorite_language.

      I've written hundreds of thousands of lines of PHP and I put security as my primary concern. None of them have been hacked because I rigorously sanitize data and don't allow users to access things they shouldn't. Yes, it's a bit of a pain to try and cover every conceivable attack vector, but you can write secure code in PHP just as you can in any language. It's not the language, it's the implementation of the code you write.

      I was answering the question as asked, not filling in the details to satisfy your curiosity.
      The relevant bit is attack surface and the reduction thereof, by doing things outside the memory space of the web server and passing all data through a well controlled pipe. You might be able to write secure code in PHP. But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to, whereas CGI is. Old school, simple, separated.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    11. Re: Further proof the web model blows by JustAnotherOldGuy · · Score: 1

      But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to

      And that was my point entirely.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    12. Re:Further proof the web model blows by Anonymous Coward · · Score: 0

      Do we have a choice? His point stands strong no matter what bullshit goof stooge incompetents like you webchumps say: Your shit blows.

    13. Re: Further proof the web model blows by TechyImmigrant · · Score: 1

      But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to

      And that was my point entirely.

      But not a contradiction of mine, which is how you cast it.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  2. High-Tech assholes! by Anonymous Coward · · Score: 0

    High-Tech assholes want to make a name for themselves. I bet they've been sitting on this just waiting for this time of year.

    1. Re:High-Tech assholes! by Anonymous Coward · · Score: 1

      High-Tech assholes want to make a name for themselves. I bet they've been sitting on this just waiting for this time of year.

      My first thought too.

  3. First by Anonymous Coward · · Score: -1

    First?!?! FIRST POST

  4. see something by turkeydance · · Score: 1

    say something. don't ask, don't tell. bacon is bad. now what was that again?

    1. Re:see something by Anonymous Coward · · Score: 0

      Eat bacon and multiply. Everything else is secondary.

  5. More like .... by drpimp · · Score: 1

    Hack Friday ... amirite?

    --
    -- Brought to you by Carl's JR
  6. shit php/MySQL by Anonymous Coward · · Score: -1

    More shit php/MySQL.

    php & MySQL so easy to use any dumb-fucker can use them without reading the manual.

    Do you really want a dumb fucker who doesn't read the manual writing your e-commerce site?

    1. Re:shit php/MySQL by Anonymous Coward · · Score: 0

      I sense much ass hurt from a php/MySQL developer.

  7. lol by Anonymous Coward · · Score: 0

    I don't know about zen cart, but it's based on osCommerce which is a nasty piece of shit.

    1. Re:lol by TechyImmigrant · · Score: 2

      I don't know about zen cart, but it's based on osCommerce which is a nasty piece of shit.

      I tried to use it. Learn from my experience. Don't.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  8. The latest version as well? by LewekLeonek · · Score: 2

    According to the original source (https://www.htbridge.com/advisory/HTB23282) the security issue affects versions 1.5.3 "and probably prior" (you gotta love the wording). When I looked at the Zen Cart site today v1.5.4 has been out for almost a year. Now someone else please take it from here...

    1. Re:The latest version as well? by Anonymous Coward · · Score: 0

      heh, and how many websites get updated? If it ain't hacked yet... well, don't look... we don't want to upgrade.

    2. Re: The latest version as well? by BarbaraHudson · · Score: 3, Insightful

      Most of the people running zencart are probably going to have to wait until their hosting provider supplies a one-click upgrade, same as Android users had to wait for their phone company to push out the upgrade that took care of stagefright, heartblead, etc.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    3. Re:The latest version as well? by TechyImmigrant · · Score: 1

      heh, and how many websites get updated? If it ain't hacked yet... well, don't look... we don't want to upgrade.

      It is the norm for these frameworks that the installation involves fifteen pages of "put that there, set that permission, put this in the apache config, install this pre-req". Tomato Cart and Zen Cart, I'm looking at you.

      By the time you finally get it running, it seems like you have a massively fragile configuration consisting of many small changes. The idea of dropping an upgraded codebase on that is akin to saying "Your website will go down for a week while you get it running again, because that's how long it took you last time".

      What is needed for a fix is instructions to "Change this line to say this" in your existing codebase. So you can make a minimally invasive change.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    4. Re:The latest version as well? by Anonymous Coward · · Score: 1

      It's not just that, the upgrade procedure is basically: Do a clean install then manually re-apply any customizations.

      It really is a massive amount of work to upgrade it.

    5. Re: The latest version as well? by _merlin · · Score: 2

      What's behind changing your sig from the previous LGBTt line to the current one that completely dissociates t from LGBT? Just curious.

    6. Re:The latest version as well? by ElBeano · · Score: 1

      Not every upgrade, but far too many are just like this ^.

    7. Re: The latest version as well? by Anonymous Coward · · Score: 0

      fags are stupid and need to die and the trannies don't want to be associated with their toxic culture?

    8. Re: The latest version as well? by BarbaraHudson · · Score: 1

      Gays, Lesbians, and Bisexuals are about sexual practices. Transgendered is a bastardized term that includes cross-dressers and drag queens, which is a sexual fetish (not that I'm criticizing this, to each their own, etc). Unfortunately, even in the LGBT, many people think that transsexuals are really just gay cross-dressers. This attitude comes from the top down, as many of the influential LGBT organizations are directed exclusively by gay white men.

      They don't get that transsexuals are different - live brain scans have proven that our brains resemble our target gender both in sexually dimorphic areas, and in the overall networking. Even the general public is often more enlightened ,,, sheesh! When they argue that they've helped transsexuals by having drag queens on their floats, it's way past time to take them seriously.

      Not that I ever had contact with any LGBT groups - didn't need to deal with their crap in addition to my own :-) But I see others buying into the whole "you need to let us keep you safe in our gay ghetto because it's a safe space where we all can live authentic lives" bullcrap. Sure, I've known a few gays and lesbians, but that doesn't mean that I need their weird brand of withdraw-from-the-world protection - I leave that to the cults.

      We achieved social acceptance long before gays came out of the closet - Christine Jorgensen is a good example of early fame and fortune. We got this reception because the vast majority of people are curious. It was only when the gay rights movement came out and started rioting that we got caught in the back-splash of religious intolerance. So, in a way, they've been riding our coat-tails to a certain extent. After all, we could marry in our target gender without enabling legislation, they couldn't.

      The worst part is, if you say any of this, "you're harming the community." My message to them is "You're not my community. My community is family, friends, neighbors, acquaintances ... without respect to color, ethnic origin, sex, sexual orientation, gender, physical or mental illness, etc ...." Rather than hiding in a gay ghetto because I need protection to live an authentic life (btw - how the heck do you live an authentic life when you're so paranoid about the rest of the world???) I help shape the world around me to be my "safe space" - for everyone.

      I also don't like the bogus "self-affirming" games that transsexuals in the LGBT movement play ... the latest one was "this year we should all wear purple to mark the Transgender Day of Remembrance." A pretty safe thing to do because nobody outside their little group even knows what it signifies ... and if it ever gets to the point where people do, will they be pressured to out themselves by cooperating? This is slacktivism. Why not wear a T-shirt that says "Yes, I am a transsexual. Any questions for me?" and a big smiley face to invite discussion. I'd wear it to the mall ... but them? "Oh noes!" "Too dangerous!" They wouldn't dare take any action to pay it forward in memory of those who fought for our rights before us. No wonder they feel they have to hide in the gay ghetto to have their "safe spaces" and lead their circumscribed "authentic lives." Deep down, they are ashamed.

      Stockholm Syndrome is what it is.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    9. Re: The latest version as well? by BarbaraHudson · · Score: 1

      I have no problem with gays, lesbians, bisexuals, drag queens, whatever - except that their attitude towards us is like a useless appendage - handy to drag out when it gains "the community" something, but otherwise ignored, or worse, blurring the line between cross-dressers, etc., and transsexuals, helping perpetuate the myth that transsexuals are really gay men in dresses.

      Toxic? You betcha! "Chuck you Farley Brown! I don't need you to tell me what I am or how to live my life" is probably a pretty muted response.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    10. Re: The latest version as well? by _merlin · · Score: 1

      Thanks for taking the time to answer in detail about your thoughts on the issue.

    11. Re: The latest version as well? by BarbaraHudson · · Score: 1

      You're welcome. The full answer is much more complex, involves going into a lot of details, etc ... I'll probably do a journal entry on it at some point. :-)

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
  9. PHP: Secure Your Site Like It's 2004 by Anonymous Coward · · Score: 0

    We don't need to escape strings, because back in 2005 we wrote a regex that checks for SQL injection attacks. It worked with all five examples we threw at it, which is basically test driven development.

  10. I can spell it fine all by my self by Anonymous Coward · · Score: 0

    D-I-S-A-S-T-E-R

  11. How will Russia celebrate Thanksgiving? by 12WTF$ · · Score: 2

    Roast Turkey, of course.

    --
    Cryonics - Keep cool and carry on.
  12. How can you tell? by freeze128 · · Score: 3, Insightful

    Zencart? How is a typical shopper supposed to know if the online retailer that they are using is using the Zencart system?

    1. Re:How can you tell? by Anonymous Coward · · Score: 2, Informative

      https://www.zen-cart.com/showcase.php

      Not the most succinct way to go about it but the big ones are on there.

    2. Re:How can you tell? by drgould · · Score: 1

      In the default configuration the phrase "Powered by Zencart" appears at the bottom of each page.

      Also, the default Zencart themes and icons are unmistakable if you know what they look like.

    3. Re:How can you tell? by kervin · · Score: 1

      Well, for example you can use builtwith.com. E.g. http://builtwith.com/adafruit.com

    4. Re:How can you tell? by Gravis+Zero · · Score: 1

      It's actually pretty obvious if they are using Zen Cart. Instead of a "checkout" button it has a "continue the cycle" button. ;)

      --
      Anons need not reply. Questions end with a question mark.
    5. Re:How can you tell? by Anonymous Coward · · Score: 0

      https://wappalyzer.com is really good for showing what tech a website is running. Browser extensions for Firefox, Chrome and Opera. A Bookmarklet for other browsers.

  13. Business Study by Anonymous Coward · · Score: 0

    Critical Zen Cart Vulnerability Could Spell Black Friday Disaster For Shoppers. This a great online sales boom. I really enjoy this post.

  14. Zen Cart is a mess by JustAnotherOldGuy · · Score: 1

    The Zen Cart code is a mess, and I'm not surprised that it has vulnerabilities.

    XCart seems much better, but it's a monster codebase. It probably has some vulnerabilities too.

    --
    Just cruising through this digital world at 33 1/3 rpm...
    1. Re:Zen Cart is a mess by keko · · Score: 2

      ZenCart is as awful as WordPress, but with credit cards.

    2. Re:Zen Cart is a mess by JustAnotherOldGuy · · Score: 1

      ZenCart is as awful as WordPress, but with credit cards.

      Not to worry, WordPress has plenty of plugins that will allow you to insecurely use your credit card in ways that would make a hacker dance with joy.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    3. Re:Zen Cart is a mess by Anonymous Coward · · Score: 0

      ZenCart is better! Comes fraud-enabled by default, no plugins!

    4. Re:Zen Cart is a mess by Anonymous Coward · · Score: 0

      AGREE!!! Zen cart code is clean and well documented. it is up to the user, ... to make a mess of it ... (Zen Cart Dev. since 2008!)

    5. Re:Zen Cart is a mess by Ice+Station+Zebra · · Score: 1

      Of course it is, it was based off of oscommerce another steaming pile of phpshit.

  15. Great timing. by Anonymous Coward · · Score: 0

    I am sure they just happened to discover the flaw at this time. It's not like they where sitting on the discovery, releasing the warning at maximum point of hysteria..

  16. Citation, Please? by brentlaminack · · Score: 1

    Could somebody post the original article that this post summarizes? e.g. Where can we get further information?

    1. Re:Citation, Please? by Anonymous Coward · · Score: 0

      It's in the summary title

  17. Not shopping by tompaulco · · Score: 1

    Because of this, or in spite of this, or regardless of this (choose one), I will not be doing any black Friday shopping. I choose not to commemorate the anniversary of the collapse of gold prices in the stock market.

    --
    If you are not allowed to question your government then the government has answered your question.
  18. "His" point? by Anonymous Coward · · Score: 0

    you both said "webchumps", are you have a bout of schizophrenia again?

  19. POC please? by Anonymous Coward · · Score: 0

    I want to own some retards running php

  20. ZenCart Patch Already on their forum... by MindlessGenius · · Score: 0

    No panic... a patch is out already.

    In Zen Cart v1.5.4 the /ajax.php file has a vulnerability which can be used to cause a server exploit under very specific conditions.

    The patch is simple: replace the /ajax.php file with the one attached below.

    https://www.zen-cart.com/showt...