Magento Flaw Puts Millions Of Ecommerce Sites At Risk

Ecommerce sites around the world could be at risk of damaging cyber-attacks following the discovery of several vulnerabilities in a popular back-end system.

Magento, a content management system popular with online retail sites, released a large number of patches that it says will help fix a variety of potentially damaging flaws in both versions of its software.

The company, which is owned by eBay and says it has over 200,000 customers around the world, including many of the most popular online retail sites, is now urging users to download the twenty patches in order to ensure their sites do not fall victim to an attack.

Vulnerable

Among the most serious vulnerabilities, first revealed by security vendor Sucuri, is a stored cross-site scripting (XSS) vulnerability which could be triggered simply by sending an email to administrators.

This issue, which affects Magento Community Edition version 1.9.2.3 and earlier, and the Enterprise Edition version 1.14.2.3 and older, is rated as critical as the rogue code can hijack an administrator’s authenticated session or can instruct his browser to perform a rogue action on the website, such as adding another administrator account with attacker-supplied credentials.

Sucuri says that it first reported the bug to Magento’s security team early in November last year, although Magento only acknowledged the vulnerability on December 1, and then did not issue a patch until last weekend.

“This vulnerability affects almost every install of Magento CE <1.9.2.3 and Magento EE <1.14.2.3,” the company said in a blog. “The buggy snippet is located inside Magento core libraries, more specifically within the administrator’s backend. Unless you’re behind a WAF or you have a very heavily modified administration panel, you’re at risk.”

XSS attacks can be hugely damaging, leading to targeted attacks against users which could lead to data being stolen.

Last April, Finnish researchers warned that WordPress, another leading CMS platform, was vulnerable to XSS attacks due to an unpatched vulnerability that could allow malicious code to be injected into website comments in order to steal user data.

Are you a security pro? Try our quiz!