Ebay-owned back end system releases patches to fix a number of damaging vulnerabilities
Ecommerce sites around the world could be at risk of damaging cyber-attacks following the discovery of several vulnerabilities in a popular back-end system.
Magento, a content management system popular with online retail sites, released a large number of patches that it says will help fix a variety of potentially damaging flaws in both versions of its software.
The company, which is owned by eBay and says it has over 200,000 customers around the world, including many of the most popular online retail sites, is now urging users to download the twenty patches in order to ensure their sites do not fall victim to an attack.
Among the most serious vulnerabilities, first revealed by security vendor Sucuri, is a stored cross-site scripting (XSS) vulnerability which could be triggered simply by sending an email to administrators.
This issue, which affects Magento Community Edition version 18.104.22.168 and earlier, and the Enterprise Edition version 22.214.171.124 and older, is rated as critical as the rogue code can hijack an administrator’s authenticated session or can instruct his browser to perform a rogue action on the website, such as adding another administrator account with attacker-supplied credentials.
Sucuri says that it first reported the bug to Magento’s security team early in November last year, although Magento only acknowledged the vulnerability on December 1, and then did not issue a patch until last weekend.
“This vulnerability affects almost every install of Magento CE <126.96.36.199 and Magento EE <188.8.131.52,” the company said in a blog. “The buggy snippet is located inside Magento core libraries, more specifically within the administrator’s backend. Unless you’re behind a WAF or you have a very heavily modified administration panel, you’re at risk.”
XSS attacks can be hugely damaging, leading to targeted attacks against users which could lead to data being stolen.
Last April, Finnish researchers warned that WordPress, another leading CMS platform, was vulnerable to XSS attacks due to an unpatched vulnerability that could allow malicious code to be injected into website comments in order to steal user data.
Are you a security pro? Try our quiz!