{"id":35876,"date":"2019-10-31T22:07:21","date_gmt":"2019-10-31T19:07:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\/"},"modified":"2019-10-31T22:07:21","modified_gmt":"2019-10-31T19:07:21","slug":"v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","title":{"rendered":"V platform\u011b e-commerce Magento bylo odstran\u011bno 75 zranitelnost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na otev\u0159en\u00e9 platform\u011b pro organizaci elektronick\u00e9ho obchodov\u00e1n\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/magento\">Magento<\/a><\/noindex>, kter\u00e1 obsazuje p\u0159ibli\u017en\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/pagely.com\/blog\/top-ecommerce-platforms-2018-compared\/\">20%<\/a><\/noindex> trh syst\u00e9m\u016f pro vytv\u00e1\u0159en\u00ed internetov\u00fdch obchod\u016f, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.ripstech.com\/2019\/magento-rce-via-xss\/\">byly odhaleny<\/a><\/noindex> zranitelnosti, jejich\u017e kombinace umo\u017e\u0148uje prov\u00e9st \u00fatok na vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du na serveru, z\u00edskat plnou kontrolu nad internetov\u00fdm obchodem a zorganizovat p\u0159esm\u011brov\u00e1n\u00ed plateb. Zranitelnosti <noindex><a rel=\"nofollow\" href=\"https:\/\/magento.com\/security\/patches\/magento-2.3.2-2.2.9-and-2.1.18-security-update-13\">odstran\u011bny<\/a><\/noindex> ve verz\u00edch Magento 2.3.2, 2.2.9 a 2.1.18, ve kter\u00fdch bylo celkem opraveno 75 probl\u00e9m\u016f souvisej\u00edc\u00edch s bezpe\u010dnost\u00ed.<\/p>\n<p>Jedn\u00edm z probl\u00e9m\u016f je, \u017ee nezabezpe\u010den\u00fd u\u017eivatel m\u016f\u017ee um\u00edstit JavaScriptov\u00fd k\u00f3d (XSS), kter\u00fd se vykon\u00e1 p\u0159i prohl\u00ed\u017een\u00ed protokolu zru\u0161en\u00fdch n\u00e1kup\u016f v administr\u00e1torsk\u00e9m rozhran\u00ed. Podstata zranitelnosti spo\u010d\u00edv\u00e1 v mo\u017enosti obch\u00e1zet operaci \u010di\u0161t\u011bn\u00ed textu prost\u0159ednictv\u00edm funkce escapeHtmlWithLinks() p\u0159i zpracov\u00e1n\u00ed pozn\u00e1mky ve formul\u00e1\u0159i zru\u0161en\u00ed na obrazovce zah\u00e1jen\u00ed objedn\u00e1vky (pou\u017eit\u00ed vno\u0159en\u00e9ho tagu &#171;a href=http:\/\/onmouseover=&#8230;&#187;). Probl\u00e9m se projevuje p\u0159i pou\u017e\u00edv\u00e1n\u00ed integrovan\u00e9ho modulu Authorize.Net, pomoc\u00ed kter\u00e9ho se prov\u00e1d\u00ed p\u0159\u00edjem plateb kreditn\u00edmi kartami.<\/p>\n<p>Aby \u00fato\u010dn\u00edk z\u00edskal plnou kontrolu pomoc\u00ed JavaScriptov\u00e9ho k\u00f3du v kontextu aktu\u00e1ln\u00edho sezen\u00ed zam\u011bstnance obchodu, je zneu\u017eita druh\u00e1 zranitelnost, kter\u00e1 umo\u017e\u0148uje nahr\u00e1t phar soubor pod z\u00e1minkou obr\u00e1zku (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49746\">prov\u00e1d\u011bn\u00ed<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49641\">\u00fatok\u016fm<\/a><\/noindex> &#171;Phar deserializace&#187;). Phar soubor m\u016f\u017ee b\u00fdt nahr\u00e1n p\u0159es formul\u00e1\u0159 pro vkl\u00e1d\u00e1n\u00ed obr\u00e1zk\u016f v integrovan\u00e9m WYSIWYG editoru. Kdy\u017e \u00fato\u010dn\u00edk dos\u00e1hne proveden\u00ed sv\u00e9ho PHP k\u00f3du, m\u016f\u017ee n\u00e1sledn\u011b zm\u011bnit platebn\u00ed \u00fadaje nebo uspo\u0159\u00e1dat odchyt\u00e1v\u00e1n\u00ed informac\u00ed o kreditn\u00edch kart\u00e1ch z\u00e1kazn\u00edk\u016f. <\/p>\n<p>Zaj\u00edmav\u00e9 je, \u017ee informace o probl\u00e9mu XSS byly zasl\u00e1ny v\u00fdvoj\u00e1\u0159\u016fm Magento ji\u017e v z\u00e1\u0159\u00ed 2018, po \u010dem\u017e na konci listopadu byla vyd\u00e1na z\u00e1plata, kter\u00e1, jak se uk\u00e1zalo, opravuje pouze jeden z konkr\u00e9tn\u00edch p\u0159\u00edpad\u016f a snadno se obch\u00e1z\u00ed. V lednu bylo nav\u00edc ohl\u00e1\u0161eno, \u017ee je mo\u017en\u00e9 nahr\u00e1t Phar soubor pod z\u00e1minkou obr\u00e1zku a uk\u00e1z\u00e1no, jak m\u016f\u017ee kombinace dvou zranitelnost\u00ed b\u00fdt vyu\u017eita k ohro\u017een\u00ed internetov\u00fdch obchod\u016f. Na konci b\u0159ezna byla v Magento 2.3.1,<br \/>\n2.2.8 a 2.1.17 opravena problematika s Phar soubory, ale oprava XSS byla opomenuta, i kdy\u017e tiket ohledn\u011b probl\u00e9mu byl uzav\u0159en. V dubnu bylo znovu zah\u00e1jeno vy\u0161et\u0159ov\u00e1n\u00ed probl\u00e9mu XSS a probl\u00e9m byl opraven ve verz\u00edch 2.3.2, 2.2.9 a 2.1.18. <\/p>\n<p>Je t\u0159eba poznamenat, \u017ee v uveden\u00fdch vyd\u00e1n\u00edch bylo tak\u00e9 odstran\u011bno 75 zranitelnost\u00ed, z nich\u017e 16 m\u00e1 hodnocen\u00ed kritick\u00e9 \u00farovn\u011b nebezpe\u010dnosti, a 20 probl\u00e9m\u016f m\u016f\u017ee v\u00e9st k prov\u00e1d\u011bn\u00ed PHP k\u00f3du nebo vkl\u00e1d\u00e1n\u00ed SQL operac\u00ed. V\u011bt\u0161inu kritick\u00fdch probl\u00e9m\u016f m\u016f\u017ee zp\u016fsobit pouze autentizovan\u00fd u\u017eivatel, ale jak bylo uvedeno v\u00fd\u0161e, dosa\u017een\u00ed prov\u00e1d\u011bn\u00ed autentizovan\u00fdch operac\u00ed nen\u00ed obt\u00ed\u017en\u00e9 pomoc\u00ed XSS zranitelnost\u00ed, kter\u00fdch bylo v uveden\u00fdch vyd\u00e1n\u00edch odstran\u011bno n\u011bkolik des\u00edtek.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51027\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 20% \u0440\u044b\u043d\u043a\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u043c \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Magento 2.3.2, 2.2.9 \u0438 2.1.18, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Na platform\u011b elektronick\u00e9ho obchodov\u00e1n\u00ed Magento bylo odstran\u011bno 75 zranitelnost\u00ed | ProHoster","description":"Na otev\u0159en\u00e9 platform\u011b pro organizaci elektronick\u00e9ho obchodov\u00e1n\u00ed Magento, kter\u00e1 zab\u00edr\u00e1 p\u0159ibli\u017en\u011b","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:21+00:00","article:modified_time":"2019-10-31T19:07:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:54:39","updated":"2026-01-22 01:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}