{"id":21375,"date":"2019-04-16T17:23:02","date_gmt":"2019-04-16T15:23:02","guid":{"rendered":"https:\/\/belvg.com\/blog\/?p=21375"},"modified":"2021-02-18T09:23:53","modified_gmt":"2021-02-18T07:23:53","slug":"how-to-install-magento-2-security-patches","status":"publish","type":"post","link":"https:\/\/belvg.com\/blog\/how-to-install-magento-2-security-patches.html","title":{"rendered":"How to Install Magento 2 Security Patches"},"content":{"rendered":"\n

Magento’s most empowering feature is its open source architecture. It allows developers to freely configure the platform and create complex custom solutions for ecommerce. Yet, open architecture has an unfortunate security vulnerability, which makes the platform subject to hacker attacks. Another reason why Magento is so prone to security attacks lies in its popularity. For today, more than 250,000 online stores around the world are powered by Magento.<\/p>\n

<\/p>\n

Table of contents:<\/strong><\/p>\n

Why do you need Magento 2 security patches?
\n<\/a>List of Magento 2 security patches
\n<\/a>How to install Magento security patches
\n<\/a>How to check Magento store security<\/a><\/p>\n

Why do you need Magento 2 security patches?<\/h2>\n

In the first Magento versions, the development policy was more focused on improving the platform and adding new features. This meant that security issues were mostly disregarded, and to get rid of a certain security vulnerability, a store owner would have to simply update their Magento to the latest version.<\/p>\n

In 2015, the Magento team decided to address the security with more attention, and since then Magento security patches have been released regularly. Even though this decision did not entirely resolve the general issue of security, it massively improved the security condition and prevented a number of hacker attacks.<\/p>\n

So, what are security patches in Magento 2? A security patch is a change of code that fixes a certain vulnerability. The fixes are supplied in the form of a self-installing patch script, which locates the place where the code fix belongs to, automatically applies the update to it and saves the result. Keep in mind that security patches rely on core code files for proper installation, which means that if you alter core code, there is a chance the patches will fail to install.<\/p>\n

But are the outcomes of ignoring security patches that severe? Here are the 4 most common consequences of a Magento store being hacked :<\/p>\n

    \n
  1. Credit card information of the customers can get stolen.<\/strong> In fact, certain Magento integrations and extensions, especially payment ones, are from time to time discovered to be attacked and abused by fraudulent hacker groups. The recent case concerned PayPal integration Payflow Pro, it was hacked and utilized for stealing debit and credit card numbers.<\/li>\n
  2. Ransomware can get installed into your webstore.<\/strong> Ransomware is the type of malicious software that encrypts your code and denies you access to it until you pay for its release.<\/li>\n
  3. Webstore server can get compromised by hackers.<\/strong> It means that it can be used for illicit activities, in particular, for sending spam emails.<\/li>\n
  4. Malware can get installed into your shop, further spreading and affecting your visitors.<\/strong> As a result, your website gets blocked by search engines until the security is restored, which results in profit loss and certain reputation damage. In severe cases, you will end up losing critical customer data.<\/li>\n<\/ol>\n

    With all that in mind, let us move to the latest Magento 2 security patches and their description.<\/p>\n

    \"Andrey_Dubina\"

    Partner With Us <\/h3>Let's discuss how to grow your business. Get a Free Quote.<\/span><\/div> Talk to Andrey<\/a><\/div>\n

    List of Magento 2 security patches<\/h2>\n

    This is the list of the most critical Magento security patches released over the last year:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
    Patch Title<\/strong><\/td>\nDescription<\/strong><\/td>\nVersions fixed in<\/strong><\/td>\n<\/tr>\n
    APPSEC-1281: Remote Code Execution if the configuration setting allowing symlinks is enabled<\/span><\/td>\nAllowSymlinks option from the configuration settings allowed to upload an image containing malicious code.<\/span><\/td>\nCE 1.9.3.3, EE 1.14.3.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1777: Remote Code Execution in DataFlow<\/span><\/td>\nDataFlow functionality utilized for uploading and executing arbitrary code.<\/span><\/td>\nCE 1.9.3.3, EE 1.14.3.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1686: Remote Code Execution in the Admin panel<\/span><\/td>\nAccess to store CMS allowed to remotely execute code.<\/span><\/td>\nCE 1.9.3.3, EE 1.14.3.3, Magento 2.0.14 and Magento 2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1320: SQL injection in Visual Merchandiser (Enterprise Edition)<\/span><\/td>\nSQL injection vulnerability in the Visual Merchandiser enabled a user with admin status to edit the database<\/span><\/td>\nEE 1.14.3.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1634: XSS in data fields<\/span><\/td>\nInability to filter data in certain admin tables allowed for cross-site scripting attacks.<\/span><\/td>\nCE 1.9.3.3, EE 1.14.3.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1759: XSS in Admin panel configuration<\/span><\/td>\nA person with the admin role can enter a malicious code that affects other admin panel pages. <\/span><\/td>\nCE 1.9.3.3, EE 1.14.3.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1549: CSRF after logout – form key not invalidated<\/span><\/td>\nForm key failed to invalidate on logout, allowing one to execute malicious commands after the admin logs out.<\/span><\/td>\nCE 1.9.3.3, EE 1.14.3.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1626: RCE in video upload<\/span><\/td>\nVideo upload functionality allowed to upload malicious PHP files.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1746: Zend Mail vulnerability – continued<\/span><\/td>\nZend Mail vulnerability was fixed in 2.0.12\/2.1.4 version, but was discovered to used to avoiding the implemented protection.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    APPSEC-1559: Possible remote code execution in email reminders<\/span><\/td>\nEmail reminder functionality enabled objects instantiation.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1752: Stored XSS in admin panel<\/span><\/td>\nUser data logged into admin panel was not escaped properly, allowing lower level admins attack other administrators.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1699: API tokens not invalidated after disabling admin user<\/span><\/td>\nAPI tokens were not invalidated after the admin user disabling, allowing for attacks or unauthorized actions.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1632: Password shown in action log (EE only)<\/span><\/td>\nUnder certain conditions, the administrator password was shown in plain text in the action log.<\/span><\/td>\nEE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1663: Mass actions do not follow ACL<\/span><\/td>\nLow-level admins were able to perform unauthorized actions.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1661: UI controllers do not follow ACL<\/span><\/td>\nLow-level admins were able to extract the data they were not authorized to access. <\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1679: APIs vulnerable to CSRF<\/span><\/td>\nSome customer authenticated APIs were vulnerable to CSRF and phishing attacks. <\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1610: Custom admin path disclosure<\/span><\/td>\nPayments module disclosed custom admin path location, allowing for password guessing or other hacks. <\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1666: Information leak<\/span><\/td>\nRequests returned by AJAX calls contained exposing configuration info.<\/span><\/td>\nCE and EE 2.0.14\/2.1.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1800: Remote Code Execution vulnerability in CMS and layouts<\/span><\/td>\nWhile creating a new CMS page, a low-level admin could introduce malicious code.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1887: Arbitrary File Disclose<\/span><\/td>\nTheme creation vulnerability, allowing to disclose or delete Magento installation system files.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1850: Arbitrary File Delete<\/span><\/td>\nThe File Delete module could be used to upload and delete arbitrary files.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1851: Arbitrary file delete + Lack of input sanitization leading to Remote Code Execution<\/span><\/td>\nLow-level Magento admin could make use of functional test vulnerability and get full remote code execution.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1567: Order history disclosure<\/span><\/td>\nGeneric order info enabled hackers to obtain full order information.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1769: Overwrite a Relative Path in Sitemap<\/span><\/td>\nSitemap generation tool could be utilized for sensitive files overwrite.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1713: Setup pages expose sensitive data<\/span><\/td>\nSensitive URL info leak, including controller location. <\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1852: CSRF + Stored Cross Site Scripting (customer group)<\/span><\/td>\nA customer group vulnerability used to create a URL for CSRF attack.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1482: Security Issue with referrer<\/span><\/td>\nA URL can be added to Magento site, redirecting users to malicious websites.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1502: Stored XSS – Add new group in Attribute set name<\/span><\/td>\nMalicious code could be injected into custom product attributes.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1494: AdminNotification Stored XSS<\/span><\/td>\nNetwork Man-in-the-middle attack could inject code on the Magento Admin RSS feed.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    APPSEC-1793: Potential file uploads solely protected by .htaccess<\/span><\/td>\nThe non-Apache installation contained executable scripting uploads that can be used for malicious purposes.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1819: Customer login authenticates two different sessions<\/span><\/td>\nIncorrect setup of an expired user session, which can be used by a hacker for access. <\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1802: Customer registration through frontend does not have anti-CSRF protection<\/span><\/td>\nCSRF protection to the customer registration process, preventing from taking over accounts.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1493: CMS Page Title Stored XSS<\/span><\/td>\nExecutable scripts can be injected into non-executable areas, such as page title.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1755: Anti-CSRF form_key is not changed after login<\/span><\/td>\nAnti-CSRF tokens did not change properly after the user logged in.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1853: CSRF + Stored Cross Site Scripting in newsletter template<\/span><\/td>\nVulnerability in newsletter templates allowed for URL creation that can be further exploited for a CSRF attack.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1729: XSS in admin order view using order status label in Magento<\/span><\/td>\nThe code can be injected into sales order records, resulting in an XSS attack.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1775: Stored Cross-Site Scripting in email template bypass<\/span><\/td>\nMalicious code can be inserted into email templates.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1591: Stored XSS on product thumbnail<\/span><\/td>\nProducts containing malicious code in the thumbnail can be added by Magento admin.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1896: Possible XSS in admin order view using order code label<\/span><\/td>\nMalicious code can be injected in the Order view.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1673: Stored xss using svg images in Favicon<\/span><\/td>\nSVG product images could contain malicious code.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1773: Injection on Page leading to DoS<\/span><\/td>\nWhile new page creation, the page counter can be modified, resulting in an integer overflow.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1577: Stored XSS in integration activation<\/span><\/td>\nMalicious code could be injected in the integration activation.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1510: Any admin user can upload Favicon Icon<\/span><\/td>\nLow-level admin could alter a favicon image for the entire website.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1545: Stored XSS through customer group name in admin panel<\/span><\/td>\nCustomer fields can be injected with scriptable code, resulting in an XSS attack.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1535: Access Control Lists not validated when using quick edit mode in tables<\/span><\/td>\nAccess Control Lists were not properly checked.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1588: Order Item Custom Option Disclosure<\/span><\/td>\nInformation about past orders can be retrieved during checkout. <\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1701: API token does not correctly expire<\/span><\/td>\nDue to incorrect expiration of customer and admin tokens, cookies can be reused for criminal purposes.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1630: Anonymous users can view upgrade progress updates<\/span><\/td>\nAn anonymous user could check Magento upgrade status by visiting an internal URL.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1628: Full Path Disclosure Web Root Directory<\/span><\/td>\nMagento installation system path was disclosed.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    APPSEC-1599: Admin login does not handle autocomplete feature correctly<\/span><\/td>\nIncorrect autocomplete in the admin panel that could result in information leak.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1709: Customer email enumeration through frontend login<\/span><\/td>\nContact emails were leaked by the account lockout mechanism.<\/span><\/td>\nMagento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-1495: Any user can interact with the sales order function despite not being authorized<\/span><\/td>\nA logged-in user could modify order fields. <\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6, Magento 2.0.16, Magento 2.1.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML<\/span><\/td>\nCustom layout XML can be used to copy any file. <\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only)<\/span><\/td>\nGift card functionality can be used to inject a malicious string<\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module)<\/span><\/td>\nAn administrator could create rule-based product relations that can trigger remote code execution. <\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2029: PHP Object Injection and Remote Code Execution (RCE) in the Admin panel (Commerce)<\/span><\/td>\nWith access to Commerce Target rule module, an administrator could create rule-based product relations that can trigger remote code execution.<\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2007: Authenticated SQL Injection when saving a category<\/span><\/td>\nThrough request data manipulation, a malicious string can be inserted into the database, triggering the SQL injection.<\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2027: CSRF is possible against Web sites, Stores, and Store Views<\/span><\/td>\nCSRF vulnerabilities allow to delete websites, stores or store views.<\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9, Magento 2.1.14, Magento 2.2.5<\/span><\/td>\n<\/tr>\n
    APPSEC-1882: The cron.php file can leak database credentials<\/span><\/td>\nDatabase credentials could be leaked if it was not possible to establish connection to the database.<\/span><\/td>\nMagento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2014: Authenticated Remote Code Execution (RCE) through the Magento admin panel (swatches module)<\/span><\/td>\nRemote control over code execution could be achieved via swatches module vulnerability.<\/span><\/td>\nMagento 2.1.14<\/span><\/td>\n<\/tr>\n
    APPSEC-2054: Remote Code Execution (RCE) via product import<\/span><\/td>\nA person with admin rights could add malicious code to the server.<\/span><\/td>\nMagento 2.1.14, Magento 2.2.5<\/span><\/td>\n<\/tr>\n
    APPSEC-2042: PHP Object Injection and RCE in the Magento 2 EE admin panel (Commerce Target Rule module)<\/span><\/td>\nPHP Object Injection and RCE in the Magento 2 EE admin panel (Commerce Target Rule module)<\/span><\/td>\nMagento 2.1.14, Magento Open Source 1.9.3.9, Magento Commerce 1.14.3.9<\/span><\/td>\n<\/tr>\n
    APPSEC-2055: PHP Object Injection and RCE in the Magento 2 Commerce admin panel (Schedule Import\/Export Configuration)<\/span><\/td>\nAn admin who had access to import\/export logic could insert malicious data used for PHP object injection and Remote Code Execution.<\/span><\/td>\nMagento 2.1.14<\/span><\/td>\n<\/tr>\n
    APPSEC-2048: SQL Injection through API<\/span><\/td>\nAn API user could, via API endpoints, perform SQL Injection<\/span><\/td>\nMagento 2.1.14, Magento 2.2.5<\/span><\/td>\n<\/tr>\n
    APPSEC-2025: Arbitrary File Delete via Product Image<\/span><\/td>\nAdmin could send modified data to the WYSIWYG admin component and delete arbitrary files.<\/span><\/td>\nMagento 2.1.14, Magento 2.2.5<\/span><\/td>\n<\/tr>\n
    APPSEC-1838: RSS session admin cookie can be used to gain Magento administrator privileges.<\/span><\/td>\nAccess to Magento Admin Portal could be gained via low privilege RSS session cookie.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6<\/span><\/td>\n<\/tr>\n
    APPSEC-1835: Exposure of Magento secret key from app\/etc\/local.xml<\/span><\/td>\nAdmin could create content that would expose sensitive Magento installation information.<\/span><\/td>\nMagento Open Source 1.9.3.6, Magento Commerce 1.14.3.6<\/span><\/td>\n<\/tr>\n
    APPSEC-1861: PHP Object Injection in product entries leading to Remote Code Execution<\/span><\/td>\nMalicious code could be injected into promo fields.<\/span><\/td>\nMagento Open Source 1.9.3.7, Magento Commerce 1.14.3.7, Magento 2.0.17, Magento 2.1.10, Magento 2.2.1<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    APPSEC-1830: PHP Object Injection in product attributes leading to Remote Code Execution<\/span><\/td>\nInjectable cookie could be inserted in the product attributes. <\/span><\/td>\nMagento Open Source 1.9.3.7, Magento Commerce 1.14.3.7, Magento 2.0.17, Magento 2.1.10, Magento 2.2.1<\/span><\/td>\n<\/tr>\n
    APPSEC-1893: PHP Object Injection in product metadata leading to Remote Code Execution<\/span><\/td>\nThe injectable code could be inserted in the swatches feature.<\/span><\/td>\nMagento 2.0.17, Magento 2.1.10, Magento 2.2.1<\/span><\/td>\n<\/tr>\n
    APPSEC-1915: Remote Code Execution in CMS Page Area<\/span><\/td>\nAdmin could create a CMS page that would be parsed incorrectly, resulting in remote code execution.<\/span><\/td>\nMagento Open Source 1.9.3.7, Magento Commerce 1.14.3.7<\/span><\/td>\n<\/tr>\n
    APPSEC-1830: PHP Object Injection in product attributes leading to Remote Code Execution<\/span><\/td>\nOne can create a widget block with malicious code.<\/span><\/td>\nMagento Open Source 1.9.3.7, Magento Commerce 1.14.3.7, Magento 2.0.17, Magento 2.1.10, Magento 2.2.1<\/span><\/td>\n<\/tr>\n
    APPSEC-1932: Remote Code Execution Using XML Injection<\/span><\/td>\nInjectable XML could be inserted into the layout table, giving an opportunity to remote code injection.<\/span><\/td>\nMagento Open Source 1.9.3.8, Magento Commerce 1.14.3.8<\/span><\/td>\n<\/tr>\n
    APPSEC-1938: Remote Code Execution – additional fix not included in SUPEE-9652<\/span><\/td>\nInformation can be inserted into a return path leading to Remote Code Execution (RCE).<\/span><\/td>\nMagento Open Source 1.9.3.8, Magento Commerce 1.14.3.8<\/span><\/td>\n<\/tr>\n
    APPSEC-1964: Remote Code Execution by (semi-)arbitrary file deletion for admin users with access to Import<\/span><\/td>\nAn XML file could be imported, giving an opportunity to Remote Code Execution (RCE).<\/span><\/td>\nMagento Open Source 1.9.3.8, Magento Commerce 1.14.3.8<\/span><\/td>\n<\/tr>\n
    APPSEC-1951: JavaScript execution in the administrator panel<\/span><\/td>\nOne could insert a script to the storefront field, leading to JavaScript code execution.<\/span><\/td>\nMagento 2.0.18, Magento 2.1.12, Magento 2.2.3<\/span><\/td>\n<\/tr>\n
    APPSEC-1952: Remote Code Execution using media upload<\/span><\/td>\nUsing a path traversal vulnerability, one could remotely execute code during the media upload process.<\/span><\/td>\nMagento 2.0.18, Magento 2.1.12, Magento 2.2.3<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2122: PHP Object Injection (POI) and Remote Code Execution (RCE) in the Magento 2.1.15 Admin<\/span><\/td>\nWith access to the Braintree payment method configuration, one can trigger code execution via PHP object injection.<\/span><\/td>\nMagento 2.1.16, Magento 2.2.7, Magento 2.3.0<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2123: PHP Object Injection (POI) and Remote Code Execution (RCE) in the Admin<\/span><\/td>\nVia Varnish configuration settings and the design configuration, one can trigger code execution via PHP object injection.<\/span><\/td>\nMagento 2.1.16, Magento 2.2.7, Magento 2.3.0<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication<\/span><\/td>\nThe attacker was able to guess the admin password via brute force requests to the RSS nodes.<\/span><\/td>\nMagento Open Source 1.9.4.0, Magento Commerce 1.14.4.0<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2198: SQL Injection vulnerability through an unauthenticated user<\/span><\/td>\nVia an SQL injection vulnerability, one can execute arbitrary code, causing data leakage.<\/span><\/td>\nMagento Open Source 1.9.4.1, Magento Commerce 1.14.4.1,Magento 2.1.17, Magento 2.2.8, Magento 2.3.1<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2261: Arbitrary code execution due to unsafe deserialization of a PHP archive<\/span><\/td>\nMalicious code can be injected via Phar deserialization vulnerability.<\/span><\/td>\nMagento Open Source 1.9.4.1, Magento Commerce 1.14.4.1,Magento 2.1.17, Magento 2.2.8, Magento 2.3.1<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2253: Arbitrary code execution due to unsafe handling of a malicious layout update<\/span><\/td>\nAn arbitrary PHP code could be executed by one with access to dataflow importer and catalog categories.<\/span><\/td>\nMagento Open Source 1.9.4.1, Magento Commerce 1.14.4.1<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2192: Remote code execution though crafted newsletter and email templates<\/span><\/td>\nThe arbitrary code could remotely be executed via crafted newsletter or email template code.<\/span><\/td>\nMagento 2.1.17, Magento 2.2.8, Magento 2.3.1<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2287: Remote code execution through email template<\/span><\/td>\nArbitrary code can be executed via email templates.<\/span><\/td>\nMagento 2.1.17, Magento 2.2.8, Magento 2.3.1<\/span><\/td>\n<\/tr>\n
    PRODSECBUG-2236: SQL Injection and cross-site scripting vulnerability in Catalog section (XSS)<\/span><\/td>\nOne can manipulate attribute_code in the Catalog section and embed malicious code through a stored cross-site scripting vulnerability or an SQL injection vulnerability<\/span><\/td>\nMagento 2.1.17, Magento 2.2.8, Magento 2.3.1<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n\n\n\n\n\n
    PRODSECBUG-2289: Arbitrary code could be executed<\/span> in the admin logging configuration<\/td>\nA user with admin privileges and access to the advanced admin logging configuration could trigger remote code execution.<\/td>\nMagento Open Source 1.9.4.2, Magento Commerce 1.14.4.2<\/td>\n<\/tr>\n
    PRODSECBUG-2262: Arbitrary code could be executed by importing malicious dataflow profiles<\/td>\nA user with privileges to edit block permission, import dataflow functionality and modify CMS content could execute arbitrary code by importing malicious dataflow profiles.<\/td>\nMagento Open Source 1.9.4.2, Magento Commerce 1.14.4.2<\/td>\n<\/tr>\n
    PRODSECBUG-2351: Arbitrary code could be executed via crafted sitemap creation<\/td>\nA user with administrator privileges to create sitemaps could execute arbitrary code by crafted filenames that included php extension within the XML filename.<\/td>\nMagento Open Source 1.9.4.2, Magento Commerce 1.14.4.2, Magento 2.1.18, Magento 2.2.9, Magento 2.3.2, SUPEE-11155<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    This is obviously an incomplete list; go to https:\/\/magento.com\/security you can find the full history of Magento security patches.<\/p>\n

    \"Andrey_Dubina\"

    Partner With Us <\/h3>Let's discuss how to grow your business. Get a Free Quote.<\/span><\/div> Talk to Andrey<\/a><\/div>\n

    Since Magento company realizes how critical it is to detect a security vulnerability before hackers do it and use it for illicit purposes, there are bounties assigned for detecting and submitting a Magento vulnerability. Find the rewards policy guidelines at https:\/\/hackerone.com\/magento.<\/p>\n

    How to install Magento security patches<\/h2>\n

    There are three ways to install Magento patches: via GitHub, manually and with a composer. Below you will find a comprehensive instruction of how to install Magento patches following these 3 techniques.<\/p>\n

    Method 1: how to install Magento patch using GitHub<\/h3>\n

    Step #1<\/strong>: create a directory for patches.<\/p>\n

    Go to the work directory of the webstore and create a patches directory for storing Magento patches.<\/p>\n

    Step #2<\/strong>: copy Magento patches to the created directory.<\/p>\n

    Use SSH, FTP-client and other suitable tools for this step.<\/p>\n

    Step #3<\/strong>: generate a patch file.<\/p>\n

    Run the following command git diff > .\/patches\/patchForModule.patch.<\/strong><\/p>\n

    In our case, we make changes in registration.php<\/strong> file of our module. The changes will look the following way:<\/p>\n

    \"install<\/a><\/p>\n

    Method 2: how to install Magento patch manually<\/h3>\n

    To install a Magento patch via Composer, use git apply<\/strong> or patch<\/strong> commands.<\/p>\n

    Connect through SSH and run one of the following commands from the root of the website:<\/p>\n

    git apply patches\/patchForModule.patch<\/strong>
    \nor
    \npatch -p1 < patches\/patchForModule.patch<\/strong><\/p>\n

    Method 3: install Magento patch with Composer<\/h3>\n

    Step #1<\/strong>: add a new module via composer for patch application.<\/p>\n

    For this, run the following command:
    \ncomposer require cweagans\/composer-patches ~1.0<\/strong><\/p>\n

    I will demonstrate this method using JS validation issue as an example https:\/\/github.com\/magento\/magento2\/issues\/21734<\/span><\/a><\/p>\n

    We can fix the issue using commits.<\/span><\/p>\n

    \"security<\/a><\/p>\n

    Step #2<\/strong>: Create two new patch files in the patches directory:<\/p>\n

    github-issue-21734-magento-ui.diff
    \n<\/b>    https:\/\/github.com\/magento\/magento2\/commit\/6bb24ef4cccf52d56ee5c8ef43c9365509075d8a.diff<\/span><\/a><\/p>\n

    github-issue-21734-magento-catalog.diff
    \n<\/b>    https:\/\/github.com\/magento\/magento2\/commit\/0add8b722cb1591a3a2b8fe74e20d492431f5b18.diff<\/span><\/a><\/p>\n

    Step #3<\/strong>: Change the paths in the patches for a root directory of the module to perform the correct update.<\/p>\n

    Before:
    \ndiff –git a\/app\/code\/Magento\/Ui\/view\/base\/web\/js\/lib\/validation\/rules.js b\/app\/code\/Magento\/Ui\/view\/base\/web\/js\/lib\/validation\/rules.js<\/strong><\/p>\n

    After:
    \ndiff –git a\/view\/base\/web\/js\/lib\/validation\/rules.js b\/view\/base\/web\/js\/lib\/validation\/rules.js<\/strong><\/p>\n

    \"security<\/a><\/p>\n

    For github-issue-21734-magento-ui.diff<\/strong> we will get<\/p>\n

    \"install<\/a><\/p>\n

    Step #4<\/strong>: Change the composer.json file.<\/p>\n

    Add patches directive to the extra directive.<\/p>\n

    \"extra\": {\r\n    \"magento-force\": \"override\",\r\n    \"patches\": {\r\n        \"magento\/module-ui\": {\r\n            \"Patch for issue 21734\": \"patches\/github-issue-21734-magento-ui.diff\"\r\n        },\r\n        \"magento\/module-catalog\": {\r\n            \"Patch for issue 21734\": \"patches\/github-issue-21734-magento-catalog.diff\"\r\n        }\r\n    }\r\n}\r\n<\/pre>\n
    Step #5<\/strong>: Apply patches and update composer.lock:<\/p>\n
    Run the following commands:<\/p>\n
    composer -v install<\/strong>
    \ncomposer update –lock<\/strong><\/p>\n
    How to check Magento store security<\/h2>\n
    Apart from regularly updating Magento security patches, it is essential to keep a close look at your store security and be able to detect system vulnerability at the early stages. Magento store security check can be performed directly via the admin panel of the store; in addition to this, there are third-party tools – Mage Report and Mage Scan – they provide store security analysis without the need to log in to the admin panel.<\/p>\n
    Method 1: How to run a security scan from Magento admin panel<\/h3>\n
    Magento Security Scan is a newly introduced tool that allows to monitor your store’s security, detect unauthorized access and update malware patches.<\/p>\n
    Step #1<\/strong>: Sign in to Magento account.<\/p>\n
    Step #2<\/strong>: Choose Security Scan<\/strong> in the panel on the left and press Go to Security Scan<\/strong> button. Tap Agree<\/strong> to continue.<\/p>\n
    Step #3<\/strong>: Click Add Site<\/strong> at the Monitored Websites field or + Add Site<\/strong> button.<\/p>\n
    Step #4<\/strong>: Verify your webstore domain ownership by entering Site URL<\/strong> and Site Name<\/strong> at the corresponding field and tap Generate Confirmation Code<\/strong>. Copy the code to the clipboard.<\/p>\n
    Step #5<\/strong>: Log in to the store admin panel. Navigate to Content<\/strong> tab -> Design<\/strong> -> Configuration<\/strong>.<\/p>\n
    \"content<\/a><\/p>\n
    Step #6<\/strong>: Expand the HTML Head<\/strong> section and paste the copied confirmation code to the Scripts and Style Sheets<\/strong> field.<\/p>\n
    \"expand<\/a><\/p>\n
    Step #7<\/strong>: Get back to Security Scan<\/strong> and press Verify Confirmation Code<\/strong> button.<\/p>\n
    Step #8<\/strong>: Configure your security scan to be run either weekly or daily. Press Submit<\/strong>.<\/p>\n
    Method 2: How to run a security scan with Mage Report<\/h3>\n
    We will run a Magento security scan on a Blaha Gartenmöbel<\/a> – home & garden webstore BelVG worked with.<\/p>\n
    Step #1<\/strong>: Go to https:\/\/www.magereport.com\/<\/p>\n
    \"mage<\/a><\/p>\n
    Step #2<\/strong>: Enter the address of the store you wish to check and press Go<\/strong>.<\/p>\n
    \"blaha<\/a><\/p>\n
    Step #3<\/strong>: Analyze the report you got. It consists of the list of patched vulnerabilities (in green boxes) and patches with unknown status (in grey boxes). You can learn more about each security patch; in some cases, there is How do I verify that I am protected?<\/em> link.<\/p>\n
    \"magereport<\/a>
    \nMethod 3: How to run a security scan with Mage Scan<\/h3>\n
    We will run a Magento security scan on a Karmaloop<\/a> – fashion and shoe webstore BelVG worked with.<\/p>\n
    Step #1<\/strong>: Go to https:\/\/magescan.com\/.<\/p>\n
    \"mage<\/a><\/p>\n
    Step #2<\/strong>: Enter the address of the store you wish to check and press Scan<\/strong>.<\/p>\n
    \"karmaloop<\/a><\/p>\n
    Step #3<\/strong>: Analyze the report you got. It consists of the following fields: Magento version, hosting provider, admin panel, logs, version control, development files, configuration fields, PHP version and web server. If there are no vulnerabilities, each box will contain the “No exposed configuration files were found<\/strong>” message.<\/p>\n
    \"karmaloop<\/a><\/p>\n
    Wrapping it up<\/h2>\n
    I hope that from my article you realized the importance of Magento security patches and learned how to install and update them.<\/p>\n
    If you are not technically adept enough to work with Magento security patches yourself and you need specialized support<\/a>, turn to BelVG team for professional patch installation<\/a>.<\/p>\n\n","protected":false},"excerpt":{"rendered":"Magento’s most empowering feature is its open source architecture. It allows developers to freely configure …","protected":false},"author":102,"featured_media":21388,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"image","meta":{"_acf_changed":false,"footnotes":""},"categories":[14,491,471,524],"tags":[],"class_list":["post-21375","post","type-post","status-publish","format-image","has-post-thumbnail","hentry","category-magento","category-magento-2","category-magento-developer","category-magento-speed-optimization","post_format-post-format-image"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t