Security

Apply patches with composers post-install-cmd

I just want to introduce another approach that will apply Magento patches, in case your Magento instance isn’t hosted on Adobe’s Cloud infrastructure or can’t be applied as explained in How to apply a composer patch provided by Adobe for some reason.

1. Update your composer.json file

Add a new section “scripts” at the end of your composer.json file and validate your file with composer validate.

"scripts": {
    "post-install-cmd": [
        "patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch"
    ]
}

"scripts": {

"post-install-cmd": [

"patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch"

]

}

If you see ./composer.json is valid you are good to move on. Btw. your composer.lock file doesn’t need to be updated.

2. Create a folder ./patches/

Create a folder ./patches/ or something similar and copy your *.patch file in there.

3. Test it

Run composer install and wait. Your script and patch should be executed after Generating autoload files just like in the below output.

Generating autoload files
98 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
> patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch
patching file vendor/magento/module-email/Model/Template/Filter.php
patching file vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

Generating autoload files

98 packages you are using are looking for funding.

Use the `composer fund` command to find out more!

> patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch

patching file vendor/magento/module-email/Model/Template/Filter.php

patching file vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

4. Deploy it

Commit your changes ( composer.json and ./patches/ ) folder and run your deployment procedure.

That’s it!

Adobe APSB22-12 – Don’t panic!

Adobe has released a critical security patch early this week on https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12– and https://helpx.adobe.com/security/products/magento/apsb22-12.html.

Of course, Adobe Commerce merchants and agencies are nervous and want to apply the security patch as soon as possible. However, I believe as long as your admin passwords are strong enough and you have control about your admin accounts, you shouldn’t be worried too much.

Here is why.

Let’s have a look at the content of the security patch.

diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php
index 1a7c3683820a..586cb485ee1f 100644
--- a/vendor/magento/module-email/Model/Template/Filter.php
+++ b/vendor/magento/module-email/Model/Template/Filter.php
@@ -618,6 +618,12 @@ public function transDirective($construction)
         }
 
         $text = __($text, $params)->render();
+
+        $pattern = '/{{.*?}}/';
+        do {
+            $text = preg_replace($pattern, '', (string)$text);
+        } while (preg_match($pattern, $text));
+
         return $this->applyModifiers($text, $modifiers);
     }
 
diff --git a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
index f2fe398c3848..78034d70ba51 100644
--- a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
+++ b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
@@ -55,6 +55,11 @@ public function process(array $construction, Template $filter, array $templateVa
             $result = $this->filterApplier->applyFromRawParam($construction['filters'], $result);
         }
 
+        $pattern = '/{{.*?}}/';
+        do {
+            $result = preg_replace($pattern, '', (string)$result);
+        } while (preg_match($pattern, $result));
+
         return $result;
     }

diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php

index 1a7c3683820a..586cb485ee1f 100644

--- a/vendor/magento/module-email/Model/Template/Filter.php

+++ b/vendor/magento/module-email/Model/Template/Filter.php

@@ -618,6 +618,12 @@ public function transDirective($construction)

}

$text = __($text, $params)->render();

+ $pattern = '/{{.*?}}/';

+ do {

+ $text = preg_replace($pattern, '', (string)$text);

+ } while (preg_match($pattern, $text));

return $this->applyModifiers($text, $modifiers);

}

diff --git a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

index f2fe398c3848..78034d70ba51 100644

--- a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

+++ b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

@@ -55,6 +55,11 @@ public function process(array $construction, Template $filter, array $templateVa

$result = $this->filterApplier->applyFromRawParam($construction['filters'], $result);

}

+ $pattern = '/{{.*?}}/';

+ do {

+ $result = preg_replace($pattern, '', (string)$result);

+ } while (preg_match($pattern, $result));

return $result;

}

The patch will update two files only that are responsible to process template variables such as email variables {{var logo_url}} or {{config path=”general/store_information/name”}} or variables within CMS pages or Static Blocks. The change is trivial and will wipe out unwanted content by using the pattern $pattern = ‘/{{.*?}}/’.

It basically means, in order to be able to exploit this issue, you must:

1. Know the admin url of a store
2. Have access to the Magento backend ( ideally admin privileges )
3. Know how to exploit the issue

So, as long as you maintain admin accounts regularly and know who is actively working in your backend, you should be fine.

However, if you have modules installed that add custom variables by injecting Magento\Email\Model\Template\Filter in combination with 3rd party services, you should probably go and install the patch with your next release.

Update: 2022/02/16

Code could possibly injected by using the customers billing or shipping address ( e.g {{trans “%name,” name=$order.getBillingAddress().getName()}} ) depending on how strong form validation is in the front-end ( My Account > Addresses or Checkout ).

Captcha Test For Your Contact Form

The following PHP script allows you to test your contact form captcha integration in Magento. If you receive any email after executing this script, you have to review your captcha integration.

<?php

$url = '{base_url}/contacts/index/post/';

$fields = array(
    'name' => urlencode('Bad spam test'),
    'email' => urlencode('somebody@gmail.com'),
    'state' => urlencode('Any State'),
    'postcode' => urlencode(''),
    'telephone' => urlencode(''),
    'comment' => urlencode('Bad spam test'),
    'recaptcha-verification-1' => urlencode('checked'),
);

$query = http_build_query($fields);

$ch = curl_init();
curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch,CURLOPT_URL, $url);
curl_setopt($ch,CURLOPT_POST, count($fields));
curl_setopt($ch,CURLOPT_POSTFIELDS, $query);

$result = curl_exec($ch);

curl_close($ch);

?>

<?php

$url = '{base_url}/contacts/index/post/';

$fields = array(

'name' => urlencode('Bad spam test'),

'email' => urlencode('somebody@gmail.com'),

'state' => urlencode('Any State'),

'postcode' => urlencode(''),

'telephone' => urlencode(''),

'comment' => urlencode('Bad spam test'),

'recaptcha-verification-1' => urlencode('checked'),

);

$query = http_build_query($fields);

$ch = curl_init();

curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);

curl_setopt($ch,CURLOPT_URL, $url);

curl_setopt($ch,CURLOPT_POST, count($fields));

curl_setopt($ch,CURLOPT_POSTFIELDS, $query);

$result = curl_exec($ch);

curl_close($ch);

You may need to add, remove or rename fields in the $field array. Don’t forget to replace {base_url} with your actual URL.

Broken Admin Panel after SUPEE-8788

After the installation of patch SUPEE-8788 in Magento 1.9.0.1 I have experienced a broken product edit form in Catalog > Manage Products > { select any product } > Edit Product. Every time when I tried to edit a product it was logging the following error message.

2016/11/04 19:52:04 [error] 16030#16030: *14543 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Undefined class constant 'XML_NODE_PRODUCT_MAX_DIMENSION' in /var/www/{project.com}/src/app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml on line 111" while reading response header from upstream, client: 115.70.205.114, server: {project.com}, request: "GET /index.php/admin/catalog_product/edit/id/549/key/2648665fef72a346f08657ca178f5a51/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "{project.com}", referrer: "http://{project.com}/index.php/admin/catalog_product/index/key/4cd6b694401f474c72d0dbd9d639e651/"

2016/11/04 19:52:04 [error] 16030#16030: *14543 FastCGI sent in stderr: "PHP message: PHP Fatal error: Undefined class constant 'XML_NODE_PRODUCT_MAX_DIMENSION' in /var/www/{project.com}/src/app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml on line 111" while reading response header from upstream, client: 115.70.205.114, server: {project.com}, request: "GET /index.php/admin/catalog_product/edit/id/549/key/2648665fef72a346f08657ca178f5a51/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "{project.com}", referrer: "http://{project.com}/index.php/admin/catalog_product/index/key/4cd6b694401f474c72d0dbd9d639e651/"

I have found a community extension in my project which was causing the problem by rewriting the complete class Mage_Catalog_Helper_Image. With diff I was able to identify all changes which I needed to copy from core to the community extension.

diff app/code/community/{Module_Name}/Catalog/Helper/Image.php app/code/core/Mage/Catalog/Helper/Image.php

1	diff app/code/community/{Module_Name}/Catalog/Helper/Image.php app/code/core/Mage/Catalog/Helper/Image.php

I just added the missing constant

const XML_NODE_PRODUCT_MAX_DIMENSION = 'catalog/product_image/max_dimension';

1	const XML_NODE_PRODUCT_MAX_DIMENSION = 'catalog/product_image/max_dimension';

and updated the method validateUploadFile().

public function validateUploadFile($filePath) {

1	public function validateUploadFile($filePath) {

Protect your AJAX controller action from malicious calls

If you are working with AJAX calls, you should at least verify where the calls are coming from.

if (strpos(Mage::helper('core/http')->getHttpReferer(), Mage::getBaseUrl()) === false)
{
    exit();
}

if (strpos(Mage::helper('core/http')->getHttpReferer(), Mage::getBaseUrl()) === false)

{

exit();

}

Please find the complete code on Gist.

Check Multiple Magento Instances with checkr

This is a quick example how you can check the visibility of specific paths of multiple Magento instances with a shell script called checkr. For example:

/var/log/system.log
/var/log/exception.log
/downloader/
/var/
/backup/
/RELEASE_NOTES.txt

For security reasons, those folders or files should never visible or accessible from outside.

1. URLs

Create a simple list with your clients’ names and its URLs. Save this file as clients.list.

Cafe;http://www.cafe.com/
Lunch;http://www.lunch.com/
Pizza;http://www.pizza.de/

Cafe;http://www.cafe.com/

Lunch;http://www.lunch.com/

Pizza;http://www.pizza.de/

2. Shell Script

#!/bin/sh

# =========================================================================
# Title             checkr.sh
# Description       Check the http response code of specific requests
# Author            Tobias Forkel
# Date              2015/07/10
# Version           0.1
# Usage             ./checkr.sh "/var/log/exception.log"
# Notes
# =========================================================================

if [[ -z $1 ]]; then
echo 'Missing parameter. Example: ./checkr.sh "/var/log/system.log"'
exit
fi

printf '%-20s %s\t %-20s %s\t %-20s %s\n' 'Name' 'Result' 'URL'

while read ROW; do

IFS=';' eval 'ROW=($ROW)'
NAME=${ROW[0]}
URL=${ROW[1]}

# Set the request URL
REQUEST=$(printf '%s%s' $URL $1)

# Receive the http code from curl
RESULT=$(curl -o /dev/null --silent --head --write-out '%{http_code}' $REQUEST)

# Output a formatted row
printf '%-20s %s\t %-20s %s\t %-20s %s\n' $NAME $RESULT $REQUEST

done < clients.list

#!/bin/sh

# =========================================================================

# Title checkr.sh

# Description Check the http response code of specific requests

# Author Tobias Forkel

# Date 2015/07/10

# Version 0.1

# Usage ./checkr.sh "/var/log/exception.log"

# Notes

# =========================================================================

if [[ -z $1 ]]; then

echo 'Missing parameter. Example: ./checkr.sh "/var/log/system.log"'

exit

printf '%-20s %s\t %-20s %s\t %-20s %s\n' 'Name' 'Result' 'URL'

while read ROW; do

IFS=';' eval 'ROW=($ROW)'

NAME=${ROW[0]}

URL=${ROW[1]}

# Set the request URL

REQUEST=$(printf '%s%s' $URL $1)

# Receive the http code from curl

RESULT=$(curl -o /dev/null --silent --head --write-out '%{http_code}' $REQUEST)

# Output a formatted row

printf '%-20s %s\t %-20s %s\t %-20s %s\n' $NAME $RESULT $REQUEST

done < clients.list

3. Run

Run this script with a custom parameter.

./checkr.sh "/var/log/system.log"

1	./checkr.sh "/var/log/system.log"

4. Results

Name                 Result	 URL                  	                   
Magento Commerce     404	 http://www.magentocommerce.com/var/log/system.log
Cafe                 301	 http://www.cafe.com/var/log/system.log
Lunch                503	 http://www.lunch.com/var/log/system.log

Name Result URL

Magento Commerce 404 http://www.magentocommerce.com/var/log/system.log

Cafe 301 http://www.cafe.com/var/log/system.log

Lunch 503 http://www.lunch.com/var/log/system.log

Find Malware in Image Files

It’s a nightmare. Your production environment was compromised and you actually don’t know how and how much data was stolen. For sure there are different ways to be compromised. In this post I just want to explain, how hackers can get full access to your production environment by using image files.

As explained on Snapfast and Sucuri it is pretty easy to store any kind of PHP code in EXIF headers. Often times it only needs a simple script to create an administrator account. If you are using third-party extensions with an image upload function or if you are late with the last security update, there is a high risk to be compromised.

You can use commands like svn status or git status to find changes, but this is no guarantee to find malicious code, because oftentimes your /media/ or similar folders are not version controlled.

Here is one simple command how you can find infected image files.

$ cd /var/www/{{{MAGENTO}}}/
$ find . -iregex '.*\.\(jpg\|gif\)' -exec grep -o -P 'base64_decode' {} \;

1 2	$ cd /var/www/{{{MAGENTO}}}/ $ find . -iregex '.*\.$jpg\\|gif$' -exec grep -o -P 'base64_decode' {} \;

In case if any file is infected, you will see the following search result.

Binary file ./media/test.jpg matches

1	Binary file ./media/test.jpg matches