Slashdot Mirror
Unpatched Magento Zero Day Leaves 200,000 Merchants Vulnerable (threatpost.com)
An anonymous reader quotes ThreatPost:
A popular version of the open source Magento ecommerce platform is vulnerable to a zero-day remote code execution vulnerability, putting as many as 200,000 online retailers at risk... According Bosko Stankovic, information security engineer at DefenseCode, despite repeated efforts to notify Magento, which began in November 2016, the vulnerability remains unpatched despite four version updates since the disclosure. Affected versions of the Magento Community Edition software include v. 2.1.6 and below. DefenseCode did not examine Magento Enterprise, the commercial version of the platform, but warns both share the same underlying vulnerable code... The remote code execution (RCE) vulnerability is tied to the default feature in Magento Community Edition that allows administrators to add Vimeo video content to product descriptions.
DefenseCode says the exploit can be mitigated by enforcing Magento's "Add Secret Keys To URLS" feature, warning in a paper that the hole otherwise "could lead to remote code execution and thus the complete system compromise including the database containing sensitive customer information such as stored credit card numbers and other payment information." Magento has confirmed the exploit, says they're investigating it, and promises they'll address it in their next patch release.
DefenseCode says the exploit can be mitigated by enforcing Magento's "Add Secret Keys To URLS" feature, warning in a paper that the hole otherwise "could lead to remote code execution and thus the complete system compromise including the database containing sensitive customer information such as stored credit card numbers and other payment information." Magento has confirmed the exploit, says they're investigating it, and promises they'll address it in their next patch release.
Patching first since 1997!
The recommended fix is to enable 'Add Secret Key to URLs', which is the default configuration. So only sites that went in and disabled this feature are vulnerable, or am I missing something?
You're trolling, but ok... RTFS:
...the commercial version of the platform, but warns both share the same underlying vulnerable code...
So even if you pay, you have the same problem.
Who else misread that as "Unpatched Magneto Zero Day"?
I think I'll have some Doritos with my aluminum foil wrapped sandwich for lunch today.
They have an Enterprise version which they sell and I doubt they are relying on "hobbyist programmers" to maintain it for them. Not to mention there are some excellent "hobbyist programmers" who work on the most widely used open source software being used all over the world. And the people reporting the vulnerability says they only reviewed the Community Edition and not the Enterprise Edition but some how know the Enterprise version has the same vulnerability. How exactly do the know the vulnerability is in the Enterprise edition? Community editions of open source software are "use at your own risk" while having a tendency to fall into the category of "you get what you pay for".
Is it still a zero-day exploit if it's the next day??
I mean, the linked article on ThreatPost is dated April 13 which was 2 days ago so doesn't that make this at least a 2-day exploit by now?
slashdot: A failed experiment.
Trump is a dangerous zero day exploit for our nation. You never know when one of his reckless statements will lead to disaster.
I think the Molasses Act is the odd one out. You can "prove" anything and hence nothing with numerology. It's a source of deep meaning only for the foolish and deranged.
When I looked at Magento it was a sieve peppered with .50 caliber holes. I passed.
So when you enter your information into an open source browser and send it to an open source server, you draw the line at the website software?
And especially not to some podunk mom and pop operation with their homespun "e-commerce" platform that their grandson set up for them five years ago.
Damn assburger trumpanzees need to be banned from the internet.