Magento Flaw Lets Cybercriminals Access E-Commerce Sites Without Authentication

Security researchers discovered a Magento flaw that could allow threat actors to penetrate and control features within the popular e-commerce site without authentication.

The Adobe-owned company rushed to offer a patch after a blog post on Sucuri late last week outlined details of an injection vulnerability dubbed PRODSECBUG-2198. Cybercriminals would have to download and crack the necessary password hashes to exploit the vulnerability, but once they do, it would be relatively simple to skim credit card numbers or install backdoors.

In fact, the Magento flaw was given a rating of 8.8, or “very easy” in terms of how readily it could be used to target e-commerce sites.

Reverse Engineering the Magento Flaw

To prove the severity of the threat, researchers said they were able to reverse engineer the official patch and create a working proof of concept of how it might be used by attackers. The vulnerability threatens e-commerce sites that use both the commercial edition of Magento and the open-source version and may go back to some of the product’s earliest releases.

So far, attacks in the wild have not been reported. However, researchers said cybercriminals could use the Magento flaw to inject SQL commands to steal admin rights, usernames and passwords, and other sensitive information. Worse, such attacks could be automated to target a wider pool of vulnerable e-commerce sites simultaneously — a serious concern given that Magento has an estimated 300,000 customers.

The patch subsequently released by Magento covers several other bugs. In the meantime, the researchers recommended monitoring for multiple hits to paths such as /catalog/product/frontend_action_synchronize, which might indicate threat actor are trying to exploit the vulnerability.

Assess Your Patch Management Posture

Effective patch management is critical to defend against threats exploiting the Magento vulnerability. Patch posture reporting can help security teams determine the severity of the threat, when a patch was released, whether other patches have since superseded it and even which machines might be offline for repair. This enables the organization to measure the effectiveness of both its patch management processes and the patches themselves in remediating threats.

Shane Schick

Writer & Editor

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Reverse Engineering the Magento Flaw

Assess Your Patch Management Posture

More from

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

Topic updates