How to Install Magento 2 Security Patches

Magento’s most empowering feature is its open source architecture. It allows developers to freely configure the platform and create complex custom solutions for ecommerce. Yet, open architecture has an unfortunate security vulnerability, which makes the platform subject to hacker attacks. Another reason why Magento is so prone to security attacks lies in its popularity. For today, more than 250,000 online stores around the world are powered by Magento.

Table of contents:

Why do you need Magento 2 security patches?
List of Magento 2 security patches
How to install Magento security patches
How to check Magento store security

Why do you need Magento 2 security patches?

In the first Magento versions, the development policy was more focused on improving the platform and adding new features. This meant that security issues were mostly disregarded, and to get rid of a certain security vulnerability, a store owner would have to simply update their Magento to the latest version.

In 2015, the Magento team decided to address the security with more attention, and since then Magento security patches have been released regularly. Even though this decision did not entirely resolve the general issue of security, it massively improved the security condition and prevented a number of hacker attacks.

So, what are security patches in Magento 2? A security patch is a change of code that fixes a certain vulnerability. The fixes are supplied in the form of a self-installing patch script, which locates the place where the code fix belongs to, automatically applies the update to it and saves the result. Keep in mind that security patches rely on core code files for proper installation, which means that if you alter core code, there is a chance the patches will fail to install.

But are the outcomes of ignoring security patches that severe? Here are the 4 most common consequences of a Magento store being hacked :

1. Credit card information of the customers can get stolen. In fact, certain Magento integrations and extensions, especially payment ones, are from time to time discovered to be attacked and abused by fraudulent hacker groups. The recent case concerned PayPal integration Payflow Pro, it was hacked and utilized for stealing debit and credit card numbers.
2. Ransomware can get installed into your webstore. Ransomware is the type of malicious software that encrypts your code and denies you access to it until you pay for its release.
3. Webstore server can get compromised by hackers. It means that it can be used for illicit activities, in particular, for sending spam emails.
4. Malware can get installed into your shop, further spreading and affecting your visitors. As a result, your website gets blocked by search engines until the security is restored, which results in profit loss and certain reputation damage. In severe cases, you will end up losing critical customer data.

With all that in mind, let us move to the latest Magento 2 security patches and their description.

Partner With Us

Let's discuss how to grow your business. Get a Free Quote.

Talk to Andrey

List of Magento 2 security patches

This is the list of the most critical Magento security patches released over the last year:

This is obviously an incomplete list; go to https://magento.com/security you can find the full history of Magento security patches.

Partner With Us

Let's discuss how to grow your business. Get a Free Quote.

Talk to Andrey

Since Magento company realizes how critical it is to detect a security vulnerability before hackers do it and use it for illicit purposes, there are bounties assigned for detecting and submitting a Magento vulnerability. Find the rewards policy guidelines at https://hackerone.com/magento.

How to install Magento security patches

There are three ways to install Magento patches: via GitHub, manually and with a composer. Below you will find a comprehensive instruction of how to install Magento patches following these 3 techniques.

Method 1: how to install Magento patch using GitHub

Step #1: create a directory for patches.

Go to the work directory of the webstore and create a patches directory for storing Magento patches.

Step #2: copy Magento patches to the created directory.

Use SSH, FTP-client and other suitable tools for this step.

Step #3: generate a patch file.

Run the following command git diff > ./patches/patchForModule.patch.

In our case, we make changes in registration.php file of our module. The changes will look the following way:

Method 2: how to install Magento patch manually

To install a Magento patch via Composer, use git apply or patch commands.

Connect through SSH and run one of the following commands from the root of the website:

git apply patches/patchForModule.patch
or
patch -p1 < patches/patchForModule.patch

Method 3: install Magento patch with Composer

Step #1: add a new module via composer for patch application.

For this, run the following command:
composer require cweagans/composer-patches ~1.0

I will demonstrate this method using JS validation issue as an example https://github.com/magento/magento2/issues/21734

We can fix the issue using commits.

Step #2: Create two new patch files in the patches directory:

github-issue-21734-magento-ui.diff
https://github.com/magento/magento2/commit/6bb24ef4cccf52d56ee5c8ef43c9365509075d8a.diff

github-issue-21734-magento-catalog.diff
https://github.com/magento/magento2/commit/0add8b722cb1591a3a2b8fe74e20d492431f5b18.diff

Step #3: Change the paths in the patches for a root directory of the module to perform the correct update.

Before:
diff –git a/app/code/Magento/Ui/view/base/web/js/lib/validation/rules.js b/app/code/Magento/Ui/view/base/web/js/lib/validation/rules.js

After:
diff –git a/view/base/web/js/lib/validation/rules.js b/view/base/web/js/lib/validation/rules.js

For github-issue-21734-magento-ui.diff we will get

Step #4: Change the composer.json file.

Add patches directive to the extra directive.

Step #5: Apply patches and update composer.lock:

Run the following commands:

composer -v install
composer update –lock

How to check Magento store security

Apart from regularly updating Magento security patches, it is essential to keep a close look at your store security and be able to detect system vulnerability at the early stages. Magento store security check can be performed directly via the admin panel of the store; in addition to this, there are third-party tools – Mage Report and Mage Scan – they provide store security analysis without the need to log in to the admin panel.

Method 1: How to run a security scan from Magento admin panel

Magento Security Scan is a newly introduced tool that allows to monitor your store’s security, detect unauthorized access and update malware patches.

Step #1: Sign in to Magento account.

Step #2: Choose Security Scan in the panel on the left and press Go to Security Scan button. Tap Agree to continue.

Step #3: Click Add Site at the Monitored Websites field or + Add Site button.

Step #4: Verify your webstore domain ownership by entering Site URL and Site Name at the corresponding field and tap Generate Confirmation Code. Copy the code to the clipboard.

Step #5: Log in to the store admin panel. Navigate to Content tab -> Design -> Configuration.

Step #6: Expand the HTML Head section and paste the copied confirmation code to the Scripts and Style Sheets field.

Step #7: Get back to Security Scan and press Verify Confirmation Code button.

Step #8: Configure your security scan to be run either weekly or daily. Press Submit.

Method 2: How to run a security scan with Mage Report

We will run a Magento security scan on a Blaha Gartenmöbel – home & garden webstore BelVG worked with.

Step #1: Go to https://www.magereport.com/

Step #2: Enter the address of the store you wish to check and press Go.

Step #3: Analyze the report you got. It consists of the list of patched vulnerabilities (in green boxes) and patches with unknown status (in grey boxes). You can learn more about each security patch; in some cases, there is How do I verify that I am protected? link.

Method 3: How to run a security scan with Mage Scan

We will run a Magento security scan on a Karmaloop – fashion and shoe webstore BelVG worked with.

Step #1: Go to https://magescan.com/.

Step #2: Enter the address of the store you wish to check and press Scan.

Step #3: Analyze the report you got. It consists of the following fields: Magento version, hosting provider, admin panel, logs, version control, development files, configuration fields, PHP version and web server. If there are no vulnerabilities, each box will contain the “No exposed configuration files were found” message.

Wrapping it up

I hope that from my article you realized the importance of Magento security patches and learned how to install and update them.

If you are not technically adept enough to work with Magento security patches yourself and you need specialized support, turn to BelVG team for professional patch installation.