{"id":293,"date":"2015-06-30T06:40:25","date_gmt":"2015-06-30T06:40:25","guid":{"rendered":"https:\/\/www.fastcomet.com\/blog\/?p=293"},"modified":"2022-06-10T07:38:09","modified_gmt":"2022-06-10T07:38:09","slug":"magento-rce-vulnerability-patched","status":"publish","type":"post","link":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched","title":{"rendered":"Magento RCE Vulnerability Patched"},"content":{"rendered":"\n<p class=\"has-drop-cap\">Around April this year, the Magento Security Team released information in the <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/magento.com\/blog\/technical\/critical-security-advisory-remote-code-execution-rce-vulnerability#.VW-lRM-qqko\" target=\"_blank\">Magento official blog<\/a> for a critical vulnerability in the application core functionality. The vulnerability was described as <a href=\"http:\/\/en.wikipedia.org\/wiki\/Arbitrary_code_execution\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">RCE<\/a> (Remote Code Execution) type and what it does is basically enabling the attackers to take control of your Magento Online Store. This you can clearly understand means that all the sensitive information for your customers like names, emails, Credit Card information and so on is immediately exposed to the attacker.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">The Solution<\/h2>\n\n\n\n<p>Soon after the vulnerability was reported Magento responded well prepared with a patch they have released earlier this year &#8211; <strong>SUPEE-5344<\/strong> which can be found on their official <a href=\"https:\/\/www.magentocommerce.com\/products\/downloads\/magento\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">download page<\/a>. The patch is pretty straight for applying and if you are experiencing any difficulties doing so our technical team will gladly apply it for you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FastComet Attack Mitigation<\/h2>\n\n\n\n<p>Here in FastComet, we take the security as one of the three most important aspects of the web hosting technology and as such, we took immediate measures to prevent this exposure for all our clients. The approach we have followed was inspired by the great article from <a href=\"https:\/\/blog.sucuri.net\/2015\/04\/magento-shoplift-supee-5344-exploits-in-the-wild.html\">Sucuri<\/a> explaining the issue in technical details and since April all the customers which did not apply the provided security patch by Magento are fully protected by our patch on web service level.<\/p>\n\n\n\n<p>This basically means that without messing with the code of our customers&#8217; websites we are protecting them from the malicious requests performed by the attackers. The patch is fully mitigating the RCE Vulnerability and none of our clients using Magento was affected by this severe vulnerability.<\/p>\n\n\n\n<p>The applied patch was deployed and tested on all our servers including our <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/www.fastcomet.com\/compare-shared-package\" target=\"_blank\">Shared Hosting Packages<\/a>, Our <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/www.fastcomet.com\/cloud-vps\" target=\"_blank\">Cloud SSD VPS<\/a> services and of course our <a href=\"https:\/\/www.fastcomet.com\/dedicated-servers\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Dedicated Servers<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Around April this year, the Magento Security Team released information in the Magento official blog for a critical vulnerability in the application core functionality. The vulnerability was described as RCE (Remote Code Execution) type and what it does is basically enabling the attackers to take control of your Magento Online Store. This you can clearly [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":610,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[140,4723],"tags":[62,141,9],"class_list":["post-293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-hosting","tag-magento","tag-patch","tag-security"],"featured_image_src":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg","author_info":{"display_name":"Christopher","author_link":"https:\/\/www.fastcomet.com\/blog\/author\/christopher"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Magento RCE Vulnerability Patched | FastComet<\/title>\n<meta name=\"description\" content=\"Magento Remote Code Execution Vulnerability (RCE) was recently discovered. ? What kind of attack is it? ?Learn from our takeaways!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Magento RCE Vulnerability Patched | FastComet\" \/>\n<meta property=\"og:description\" content=\"Magento Remote Code Execution Vulnerability (RCE) was recently discovered. ? What kind of attack is it? ?Learn from our takeaways!\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched\" \/>\n<meta property=\"og:site_name\" content=\"FastComet Blog\" \/>\n<meta property=\"article:published_time\" content=\"2015-06-30T06:40:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-10T07:38:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Christopher\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Magento RCE Vulnerability Patched | FastComet","description":"Magento Remote Code Execution Vulnerability (RCE) was recently discovered. ? What kind of attack is it? ?Learn from our takeaways!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched","og_locale":"en_US","og_type":"article","og_title":"Magento RCE Vulnerability Patched | FastComet","og_description":"Magento Remote Code Execution Vulnerability (RCE) was recently discovered. ? What kind of attack is it? ?Learn from our takeaways!","og_url":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched","og_site_name":"FastComet Blog","article_published_time":"2015-06-30T06:40:25+00:00","article_modified_time":"2022-06-10T07:38:09+00:00","og_image":[{"width":1024,"height":620,"url":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg","type":"image\/jpeg"}],"author":"Christopher","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Christopher","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#article","isPartOf":{"@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched"},"author":{"name":"Christopher","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/e70bae8b5451b247e36928e336317827"},"headline":"Magento RCE Vulnerability Patched","datePublished":"2015-06-30T06:40:25+00:00","dateModified":"2022-06-10T07:38:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched"},"wordCount":297,"commentCount":0,"image":{"@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#primaryimage"},"thumbnailUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg","keywords":["magento","patch","security"],"articleSection":["Security","Web Hosting"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched","url":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched","name":"Magento RCE Vulnerability Patched | FastComet","isPartOf":{"@id":"https:\/\/www.fastcomet.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#primaryimage"},"image":{"@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#primaryimage"},"thumbnailUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg","datePublished":"2015-06-30T06:40:25+00:00","dateModified":"2022-06-10T07:38:09+00:00","author":{"@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/e70bae8b5451b247e36928e336317827"},"description":"Magento Remote Code Execution Vulnerability (RCE) was recently discovered. ? What kind of attack is it? ?Learn from our takeaways!","breadcrumb":{"@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#primaryimage","url":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg","contentUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2015\/06\/magento-patches.jpg","width":1024,"height":620},{"@type":"BreadcrumbList","@id":"https:\/\/www.fastcomet.com\/blog\/magento-rce-vulnerability-patched#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fastcomet.com\/blog"},{"@type":"ListItem","position":2,"name":"Magento RCE Vulnerability Patched"}]},{"@type":"WebSite","@id":"https:\/\/www.fastcomet.com\/blog\/#website","url":"https:\/\/www.fastcomet.com\/blog\/","name":"FastComet Blog","description":"FastComet Web Hosting Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fastcomet.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/e70bae8b5451b247e36928e336317827","name":"Christopher","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/99f135e26f1ad748551251c1956e4aae0bd3bcc11af8e071075359b134894941?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/99f135e26f1ad748551251c1956e4aae0bd3bcc11af8e071075359b134894941?s=96&d=mm&r=g","caption":"Christopher"},"description":"Christopher has many years of experience leading teams in the fields of Technical support, Server Administration, and Product Development. He mainly works on the backend, helping to create the infrastructure that powers FastComet. He is responsible for flawless migrations and quick and efficient answers to client questions. He also monitors our network status and jumps in to solve time-sensitive issues like DDoS attacks and stops malicious attempts in their tracks. Christopher\u2019s primarily responsible for making sure that our servers purr along, and has worked tirelessly to improve automation at FastComet.","sameAs":["https:\/\/www.fastcomet.com"],"url":"https:\/\/www.fastcomet.com\/blog\/author\/christopher"}]}},"_links":{"self":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/comments?post=293"}],"version-history":[{"count":3,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/293\/revisions"}],"predecessor-version":[{"id":3555,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/293\/revisions\/3555"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/media\/610"}],"wp:attachment":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/media?parent=293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/categories?post=293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/tags?post=293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}