Though a remote code execution vulnerability in Magento was recently patched, it could have left more than 200,000 online retailers open to cybercriminal attacks, according to a security researcher.
In a blog post, a member of Check Point Software Technologies’ malware and vulnerability team provided details around the vulnerability in Magento — the e-commerce platform owned by eBay — that was first discovered a few months ago. The company notified eBay shortly thereafter. Through a so-called “white hat hacking” attempt, the researcher discovered a number of flaws that could have potentially allowed cybercriminals to take over a Web server and execute PHP code. That means any store running Magento could have seen financial data such as credit card numbers stolen and cybercriminals gaining administrator-level access.
Though Check Point wasn’t aware of anyone actually exploiting the Magento vulnerability, the consequences could have been severe. According to a story on Threatpost, Magento is used by 30 percent of the e-commerce market and includes major brands such as Nike among its core customers. Thankfully, eBay took action quickly, and customers have been informed and urged to patch their systems accordingly.
Given that customers have had to contend with major cyberattacks in physical stores such as Target and Home Depot, the expectations around a safe online shopping experience have arguably never been higher. For eBay in particular, the vulnerability in Magento is just the latest in a string of security concerns. Just a few weeks ago, researchers revealed that the way eBay was handling the file path in messages could have led to drive-by attacks.
Experts told SC Magazine that if nothing else, retailers who set up shop online should start to think of their sites not merely as a way to conduct business, but rather as an endpoint that needs to be as secure as anything else they own. Besides applying the patch, it is a good idea to change admin passwords and conduct some analysis to spot any recent suspicious activity.
Although some software systems aren’t updated very often, there is a good chance those in charge of e-commerce will be vigilant about the Magento vulnerability. As Infosecurity Magazine pointed out, the product is available for free but makes use of many open-source components. That suggests it may often be customized and, therefore, those deploying it would pay attention to these types of security issues.
Image Source: iStock