{"id":35876,"date":"2019-10-31T22:07:21","date_gmt":"2019-10-31T19:07:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\/"},"modified":"2019-10-31T22:07:21","modified_gmt":"2019-10-31T19:07:21","slug":"v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","title":{"rendered":"La plateforme de commerce \u00e9lectronique Magento a corrig\u00e9 75 vuln\u00e9rabilit\u00e9s.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dans une plateforme ouverte pour l'organisation du commerce \u00e9lectronique, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/magento\">Magento<\/a><\/noindex>, qui d\u00e9tient environ <noindex><a rel=\"nofollow\" href=\"https:\/\/pagely.com\/blog\/top-ecommerce-platforms-2018-compared\/\">20%<\/a><\/noindex> du march\u00e9 des syst\u00e8mes de cr\u00e9ation de boutiques en ligne, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.ripstech.com\/2019\/magento-rce-via-xss\/\">ont \u00e9t\u00e9 identifi\u00e9es<\/a><\/noindex> les vuln\u00e9rabilit\u00e9s, dont la combinaison permet de mener des attaques pour ex\u00e9cuter du code sur le serveur, obtenir un contr\u00f4le total sur la boutique en ligne et organiser la redirection des paiements. Les vuln\u00e9rabilit\u00e9s <noindex><a rel=\"nofollow\" href=\"https:\/\/magento.com\/security\/patches\/magento-2.3.2-2.2.9-and-2.1.18-security-update-13\">r\u00e9solus<\/a><\/noindex> dans les versions Magento 2.3.2, 2.2.9 et 2.1.18, o\u00f9 un total de 75 probl\u00e8mes de s\u00e9curit\u00e9 ont \u00e9t\u00e9 corrig\u00e9s.<\/p>\n<p>L'un des probl\u00e8mes permet \u00e0 un utilisateur non authentifi\u00e9 d'injecter du code JavaScript (XSS), qui peut \u00eatre ex\u00e9cut\u00e9 lors de la consultation du journal des commandes annul\u00e9es dans l'interface administrateur. Le c\u0153ur de la vuln\u00e9rabilit\u00e9 r\u00e9side dans la possibilit\u00e9 de contourner l'op\u00e9ration de nettoyage du texte \u00e0 l'aide de la fonction escapeHtmlWithLinks() lors du traitement des notes dans le formulaire d'annulation \u00e0 l'\u00e9cran de d\u00e9marrage du processus d'achat (en utilisant une balise &lt;a href=http:\/\/onmouseover=\u2026). Le probl\u00e8me se manifeste lors de l&#039;utilisation du module int\u00e9gr\u00e9 Authorize.Net, qui permet d&#039;accepter les paiements par carte de cr\u00e9dit.<\/p>\n<p>Pour obtenir un contr\u00f4le total par le biais de code JavaScript dans le contexte de la session actuelle de l'employ\u00e9 de la boutique, la deuxi\u00e8me vuln\u00e9rabilit\u00e9 est exploit\u00e9e, permettant de t\u00e9l\u00e9charger un fichier phar sous pr\u00e9texte d'une image (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49746\">r\u00e9alisation<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49641\">les attaques<\/a><\/noindex> \u00ab D\u00e9s\u00e9rialisation Phar \u00bb. Un fichier Phar peut \u00eatre charg\u00e9 via le formulaire d'insertion d'images dans l'\u00e9diteur WYSIWYG int\u00e9gr\u00e9. En r\u00e9ussissant \u00e0 ex\u00e9cuter son code PHP, l'attaquant peut alors modifier les informations de paiement ou intercepter les informations de carte de cr\u00e9dit des clients. <\/p>\n<p>Il est int\u00e9ressant de noter que des informations sur le probl\u00e8me de XSS ont \u00e9t\u00e9 envoy\u00e9es aux d\u00e9veloppeurs de Magento d\u00e8s septembre 2018, apr\u00e8s quoi un patch a \u00e9t\u00e9 publi\u00e9 fin novembre, qui, il s'est av\u00e9r\u00e9, corrigeait seulement un des cas particuliers et pouvait facilement \u00eatre contourn\u00e9. En janvier, il a \u00e9galement \u00e9t\u00e9 signal\u00e9 la possibilit\u00e9 de t\u00e9l\u00e9charger un fichier Phar sous pr\u00e9texte d'image et il a \u00e9t\u00e9 montr\u00e9 comment la combinaison de deux vuln\u00e9rabilit\u00e9s peut \u00eatre utilis\u00e9e pour compromettre les boutiques en ligne. Fin mars, dans Magento 2.3.1,<br \/>\n2.2.8 et 2.1.17, le probl\u00e8me des fichiers Phar a \u00e9t\u00e9 corrig\u00e9, mais la correction de XSS a \u00e9t\u00e9 oubli\u00e9e, bien qu'un ticket sur le probl\u00e8me ait \u00e9t\u00e9 ferm\u00e9. En avril, l'analyse de XSS a repris et le probl\u00e8me a \u00e9t\u00e9 corrig\u00e9 dans les versions 2.3.2, 2.2.9 et 2.1.18. <\/p>\n<p>Il convient de noter que dans les versions signal\u00e9es, 75 vuln\u00e9rabilit\u00e9s ont \u00e9galement \u00e9t\u00e9 corrig\u00e9es, dont 16 ont \u00e9t\u00e9 class\u00e9es comme critiques, et 20 probl\u00e8mes peuvent permettre l'ex\u00e9cution de code PHP ou l'injection de requ\u00eates SQL. La plupart des probl\u00e8mes critiques ne peuvent \u00eatre exploit\u00e9s que par un utilisateur authentifi\u00e9, mais comme mentionn\u00e9 ci-dessus, il n'est pas difficile d'accomplir des op\u00e9rations authentifi\u00e9es via des vuln\u00e9rabilit\u00e9s XSS, dont plusieurs dizaines ont \u00e9t\u00e9 corrig\u00e9es dans les versions signal\u00e9es.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51027\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 20% \u0440\u044b\u043d\u043a\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u043c \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Magento 2.3.2, 2.2.9 \u0438 2.1.18, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4775 vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es sur la plateforme de commerce \u00e9lectronique Magento | ProHoster","description":"Sur la plateforme ouverte de commerce \u00e9lectronique Magento, qui repr\u00e9sente environ","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:21+00:00","article:modified_time":"2019-10-31T19:07:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:54:39","updated":"2026-01-22 01:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/35876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=35876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/35876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=35876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=35876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=35876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}