April 23, 2015 By Shane Schick 2 min read

Though a remote code execution vulnerability in Magento was recently patched, it could have left more than 200,000 online retailers open to cybercriminal attacks, according to a security researcher.

In a blog post, a member of Check Point Software Technologies’ malware and vulnerability team provided details around the vulnerability in Magento — the e-commerce platform owned by eBay — that was first discovered a few months ago. The company notified eBay shortly thereafter. Through a so-called “white hat hacking” attempt, the researcher discovered a number of flaws that could have potentially allowed cybercriminals to take over a Web server and execute PHP code. That means any store running Magento could have seen financial data such as credit card numbers stolen and cybercriminals gaining administrator-level access.

Though Check Point wasn’t aware of anyone actually exploiting the Magento vulnerability, the consequences could have been severe. According to a story on Threatpost, Magento is used by 30 percent of the e-commerce market and includes major brands such as Nike among its core customers. Thankfully, eBay took action quickly, and customers have been informed and urged to patch their systems accordingly.

Given that customers have had to contend with major cyberattacks in physical stores such as Target and Home Depot, the expectations around a safe online shopping experience have arguably never been higher. For eBay in particular, the vulnerability in Magento is just the latest in a string of security concerns. Just a few weeks ago, researchers revealed that the way eBay was handling the file path in messages could have led to drive-by attacks.

Experts told SC Magazine that if nothing else, retailers who set up shop online should start to think of their sites not merely as a way to conduct business, but rather as an endpoint that needs to be as secure as anything else they own. Besides applying the patch, it is a good idea to change admin passwords and conduct some analysis to spot any recent suspicious activity.

Although some software systems aren’t updated very often, there is a good chance those in charge of e-commerce will be vigilant about the Magento vulnerability. As Infosecurity Magazine pointed out, the product is available for free but makes use of many open-source components. That suggests it may often be customized and, therefore, those deploying it would pay attention to these types of security issues.

Image Source: iStock

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today