Information Leakage APPSEC-1809 Magento Scan Result

[MazeStricks]

Hello Guys, I got some error message from the Magento scan results. 

Any ideas how to fix this one. Since I applied all the possible patch for the store. On the staging website it's not showing the same error as that.

Looking forward to hear ideas from you guys. 

Thanks!

[fieldcutter]

Are you running fail2ban or similar ?

If so whitelist the ip addresses used by the Magento scanner

Check your apache or nginx  logs and hopefully you'll see the addresses

Do wait a a few days, as we think the scan results are getting cached

[MazeStricks]

Hello @fieldcutter ,

Thanks for your reply. The site is using a Cpanel managed by WHM. And running under apache2. Thanks for your suggestion I will try that one. 

Regards!

[groundspeakops]

Were you ever able to get any other info on this problem?   

Our security scan started flagging it for us APPSEC-1809 in late May, early June.   We were running 2.2.5 at the time and our dev environment which was running 2.2.8 did not have the reported problem.  However, when we upgraded our production site to 2.2.8 the production site continued to fail with the same warning.  

The article provided references a security fix in 2.2.3 and does not reference APPSEC-1809 at all.

[MazeStricks]

Hello there,

Have you tried checking your site's server Firewall? 
Let me know on how it goes. 

Thanks!

[MazeStricks]

Also we're the same the site that has a problem with that scan result is also running under Magento 2.2

[fieldcutter]

Hi

No we never did get any real answers.  The results seem inconsistent, one time it will say OK and another time not.

It's possible that security measures such as fail2ban may be in play, but cannot verify this.

Magento have just released a bunch of updates, including 2.3.2 so we'll see what happens after we update

[MazeStricks]

Hello there,

Please try to whitelist the Magento scanner IP from your fail2ban security. I suspect that's one of the reason, I've read about similar issue to this one in this community. If I remember it right someone told me that Magento Scanner is interpreted to be spoofing the server that's why the security measure of the server blocked the source IP. 

Let me know on how it goes from your end.

Thanks

[groundspeakops]

For my situation above,  it appears that an older version of PHP/NGINX caused this to flag.  Upgrading both resolved the issue.  This makes sense with how things were behaving differently with our staging and production environments. 

[fieldcutter]

Interesting, thanks.

However we're on PHP 7.2 and still have the problem