A New 0-Day Magento Vulnerability Released

[getastra]

Security researchers at Defence Code have found a critical vulnerability in Magento Enterprise and Magento Community editions. While earlier Magento team had a few delayed responses, but now seems that they've have released a patch for the same.

Vulnerability: It is a remote code execution vulnerability clubbed with CSRF

You can read the details here, and if you think you are vulnerable it is advisable to put necessary patches: https://www.getastra.com/blog/0-day-magento-vulnerability-put-users-on-red-alert/

I'm around if any questions are there.

-Dylan

[Talesh · Accepted solution]

This is not a 0-day! The Defense Code "exploit" requires a very specific list of security features to be turned off which are ON by default. 200,000 sites are not affected, that is a completely wrong statistic. The blog post linked above makes no effort to verify those numbers.

The community have verified multiple times that there is no danger to merchants at this time from this issue, but we are encouraging everyone to sign up for Magento security newsletter at https://magento.com/security to make sure that if any developments do emerge you'll hear from Magento themselves.

This is just old/fake news.

[Steve Robbins]

This is tagged as Magento 1 but mentions app/etc/env.php which is only present in Magento 2.  Yeah right there are 200k customers at risk, there aren't even that many M2 installs.

Stop writing click bait.

[getastra]

True Talesh. This is an error on our part. I have got the article updated with the information you mentioned. Also, have added the comment with your mention. Please check if it's fine by you.

[getastra]

Steve. this wasn't aimed to be a click bait. Yes, an error in verifying from our part which has been rectified. As you would see on the blog and our upcoming articles, we have contributed in the past in making Magento extensions etc. secure. Again, apologies for this hiccup.