Admin routing compatibility mode for extensions

[jamieselesti]

If I enable Admin routing compatibility mode for extensions Magento states that security of the admin would be weaken.

http://prntscr.com/8z9rqx

Please could someone explain exactly how it would be weaken? I have an instance where I have 20+ extensions which need this enabled to trying to figure out exactly what the security risks are

[Mukesh Tiwari]

Hi @jamieselesti

Check following link https://magento.com/security/patches/supee-6788-technical-details and read

APPSEC-1034, addressing bypassing custom admin URL section.

I will try to post more information here.

[jamieselesti]

I was after a more in depth technical answer as in if its enabled and you did the following things you could gain access to x y & z.

[Talesh]

I don't think it makes sense to explain the inner workings of an exploit on a public forum. There are enough script kiddies running around as it is. DM me and I'll explain how it works privately.