{"id":35876,"date":"2019-10-31T22:07:21","date_gmt":"2019-10-31T19:07:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\/"},"modified":"2019-10-31T22:07:21","modified_gmt":"2019-10-31T19:07:21","slug":"v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","title":{"rendered":"Pe platforma de comer\u021b electronic Magento au fost remediate 75 de vulnerabilit\u0103\u021bi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pe o platform\u0103 deschis\u0103 pentru organizarea comer\u021bului electronic Magento<\/a><\/noindex>, care de\u021bine aproximativ 20%<\/a><\/noindex> din pia\u021ba sistemelor pentru crearea magazinelor online, au fost identificate<\/a><\/noindex> vulnerabilit\u0103\u021bi, combina\u021bia c\u0103ror permite efectuarea unui atac pentru a rula codul s\u0103u pe server, ob\u021binerea controlului total asupra magazinului online \u0219i organizarea redirec\u021bion\u0103rii pl\u0103\u021bilor. Vulnerabilit\u0103\u021bile remediate<\/a><\/noindex> \u00een versiunile Magento 2.3.2, 2.2.9 \u0219i 2.1.18, \u00een care au fost eliminate \u00een total 75 de probleme legate de securitate.<\/p>\n

Una dintre probleme permite unui utilizator neautentificat s\u0103 plaseze cod JavaScript (XSS), care poate fi executat atunci c\u00e2nd vizualizeaz\u0103 jurnalul comenzilor anulate \u00een interfa\u021ba de administrare. Esen\u021ba vulnerabilit\u0103\u021bii const\u0103 \u00een posibilitatea de a ocoli opera\u021biunea de cur\u0103\u021bare a textului prin func\u021bia escapeHtmlWithLinks() \u00een procesarea notelor din formularul de anulare pe ecranul de \u00eenceput al procesului de achizi\u021bie (utilizarea unui tag «a href=http:\/\/onmouseover=…» \u00eenvelit \u00een alt tag). Problema apare atunci c\u00e2nd se utilizeaz\u0103 modulul \u00eencorporat Authorize.Net, care permite acceptarea pl\u0103\u021bilor cu carduri de credit.<\/p>\n

Pentru a ob\u021bine control total prin intermediul codului JavaScript \u00een contextul sesiunii curente a angajatului magazinului, este exploatat\u0103 a doua vulnerabilitate, care permite \u00eenc\u0103rcarea unui fi\u0219ier phar sub forma unei imagini (auditelor \u0219i \u00eembun\u0103t\u0103\u021birilor de securitate pentru proiectele open-source critice, crearea de instrumente pentru<\/a><\/noindex> atacuri<\/a><\/noindex> «Deserializarea Phar»). Un fi\u0219ier Phar poate fi \u00eenc\u0103rcat prin formularul de inserare a imaginilor din editorul WYSIWYG \u00eencorporat. Dup\u0103 ce execut\u0103 codul s\u0103u PHP, atacatorul poate modifica ulterior detaliile pl\u0103\u021bilor sau poate organiza interceptarea informa\u021biilor despre cardurile de credit ale clien\u021bilor. <\/p>\n

Interesant este c\u0103 informa\u021biile despre problema XSS au fost trimise dezvoltatorilor Magento \u00eenc\u0103 din septembrie 2018, dup\u0103 care, la sf\u00e2r\u0219itul lunii noiembrie, a fost lansat un patch, care, se pare, rezolv\u0103 doar unul dintre cazurile particulare \u0219i poate fi evitat cu u\u0219urin\u021b\u0103. \u00cen ianuarie, a fost raportat\u0103 \u00een plus posibilitatea \u00eenc\u0103rc\u0103rii unui fi\u0219ier Phar sub forma unei imagini \u0219i s-a ar\u0103tat cum combina\u021bia celor dou\u0103 vulnerabilit\u0103\u021bi poate fi utilizat\u0103 pentru a compromite magazinele online. La sf\u00e2r\u0219itul lunii martie, \u00een Magento 2.3.1,
\n2.2.8 \u0219i 2.1.17 a fost rezolvat\u0103 problema cu fi\u0219ierele Phar, dar repara\u021bia XSS a fost uitat\u0103, de\u0219i ticketul despre problem\u0103 a fost \u00eenchis. \u00cen aprilie, analiza XSS a fost reluat\u0103 \u0219i problema a fost rezolvat\u0103 \u00een versiunile 2.3.2, 2.2.9 \u0219i 2.1.18. <\/p>\n

Este important de men\u021bionat c\u0103 \u00een versiunile men\u021bionate au fost remediate 75 de vulnerabilit\u0103\u021bi, dintre care 16 au fost clasificate cu un nivel de risc critic, iar 20 de probleme pot duce la executarea codului PHP sau la injectarea de comenzi SQL. Majoritatea problemelor critice pot fi exploatate doar de utilizatori autentifica\u021bi, dar a\u0219a cum s-a ar\u0103tat mai sus, ob\u021binerea unei sesiuni autentificate nu este dificil\u0103 utiliz\u00e2nd vulnerabilit\u0103\u021bile XSS, dintre care \u00een versiunile men\u021bionate au fost remediate c\u00e2teva zeci.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 20% \u0440\u044b\u043d\u043a\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u043c \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Magento 2.3.2, 2.2.9 \u0438 2.1.18, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Au fost remediate 75 de vulnerabilit\u0103\u021bi \u00een platforma de comer\u021b electronic Magento | ProHoster","description":"pe platforma deschis\u0103 pentru organizarea comer\u021bului electronic Magento, care ocup\u0103 aproximativ","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:21+00:00","article:modified_time":"2019-10-31T19:07:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:54:39","updated":"2026-01-22 01:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}