Update Feb 21st, 2022: Sansec has observed the first actual attacks in the wild. Patch now! Unfortunately, this validates our previous prediction that abuse would start within days. Attacks are coming from 45.134.20.11 and target a variety of URL endpoints, making it harder to add protection via a WAF/firewall. Magento 2 merchants should really patch now.
Update Feb 17th, 2022: Adobe has released another emergency patch. Merchants running Magento 2.3.3 and above need to urgently apply both patches:
The text below has been updated.
If you are running Magento 2.3 or 2.4, install both patches from Adobe asap, ideally within the next few hours.
If you are running a version of Magento 2 between 2.3.3 and 2.3.7, you should be able to manually apply the patches as it only concerns a few lines.
If you are running Magento 2.3.3 or below, you are not directly vulnerable. However, Sansec still recommends to manually implement the patches (at the very least the code changes that affect vendor/magento/module-email/Model/Template/Filter.php).
For anyone using vaimo/composer-patches, you can apply the patch file across magento/framework and magento/module-email like this (credits Luke Rodgers), it will apply both patches in the correct order.
"patches": {
"*": {
"Apply MDVA-43395": {
"source": "patches/magento/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch",
"targets": [
"magento/framework",
"magento/module-email"
]
},
"Apply MDVA-43443": {
"source": "patches/magento/MDVA-43443_EE_2.4.2-p2_COMPOSER_v1.patch",
"targets": [
"magento/framework",
"magento/module-email"
],
"after": "MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch"
}
},
More detailed guides on how to implement these patches using composer:
Due to the dynamic nature of the vulnerability, there is currently no method to filter on this attack pattern via a proxy or webserver. In order to identify attack probes, you could log HTTP POST requests with the following in the body. It may produce false positives so should be manually examined.
{{ .... }}
These vulnerabilities have a similar severity as the Magento Shoplift vulnerability from 2015. At that time, nearly all unpatched Magento stores globally were compromised in the days after the exploit publication.
We strongly recommend merchants to implement counter measures today. Our eComscan security monitor will alert you about any unpatched or incorrectly patched installations.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。