An unpatched vulnerability in the Magento e-commerce platform could allow hackers to upload and execute malicious code on web servers that host online shops . The flaw was discovered Vulnerability-related.DiscoverVulnerability by researchers from security consultancy DefenseCode and is located in Vulnerability-related.DiscoverVulnerability a feature that retrieves preview images for videos hosted on Vimeo . Such videos can be added to product listings in Magento . The DefenseCode researchers determined that if the image URL points to a different file , for example a PHP script , Magento will download the file in order to validate it . If the file is not an image , the platform will return a `` Disallowed file type '' error , but wo n't actually remove it from the server . An attacker with access to exploit this flaw could achieve remote code execution by first tricking Magento to download an .htaccess configuration file that enables PHP execution inside the download directory and then downloading the malicious PHP file itself . Once on the server , the PHP script can act as a backdoor and can be accessed from an external location by pointing the browser to it . For example , attackers could use it to browse the server directories and read the database password from Magento 's configuration file . This can expose customer information stored in the database , which in the case of online shops , can be very sensitive . The only limitation is that this vulnerability can not be exploited Vulnerability-related.DiscoverVulnerability directly because the video-linking functionality requires authentication . This means attackers need to have access to an account on the targeted website , but this can be a lower-privileged user and not necessarily an administrator . The authentication obstacle can also be easily overcome if the website does n't have the `` Add Secret Key to URLs '' option turned on . This option is intended to prevent cross-site request forgery ( CSRF ) attacks and is enabled by default . CSRF is an attack technique that involves forcing a user ’ s browser to perform an unauthorized request on a website when visiting a different one . `` The attack can be constructed as simple as < img src=… in an email or a public message board , which will automatically trigger the arbitrary file upload if a user is currently logged into Magento , '' the DefenseCode researchers said in an advisory . `` An attacker can also entice the user to open a CSRF link using social engineering . '' This means that by simply clicking on a link in an email or by visiting a specifically crafted web page , users who have active Magento sessions in their browser might have their accounts abused to compromise websites . The DefenseCode researchers claim Vulnerability-related.DiscoverVulnerability that they 've reported Vulnerability-related.DiscoverVulnerability these issues to the Magento developers back in November , but received no information regarding patching plans Vulnerability-related.PatchVulnerability since then . Several versions of the Magento Community Edition ( CE ) have been released since November , the most recent one being 2.1.6 on Tuesday . According to DefenseCode , all Magento CE versions continue to be vulnerable Vulnerability-related.DiscoverVulnerability , which is what prompted them to go public Vulnerability-related.DiscoverVulnerability about the flaw . “ We have been actively investigating Vulnerability-related.DiscoverVulnerability the root cause of the reported issue and are not aware of any attacks in the wild , ” Magento , the company that oversees development of the e-commerce platform , said in an emailed statement . “ We will be addressing Vulnerability-related.PatchVulnerability the issue in our next patch release and continue to consistently work to improve our assurance processes. ” `` All users are strongly advised to enforce the use of 'Add Secret Key to URLs ' which mitigates the CSRF attack vector , '' the DefenseCode researchers said . `` To prevent remote code execution through arbitrary file upload the server should be configured to disallow .htaccess files in affected directories . '' Magento is used by over 250,000 online retailers , making it an attractive target for hackers . Last year , researchers found thousands of Magento-based online shops that had been compromised Attack.Databreach and infected with malicious code that skimmed Attack.Databreach payment card details .

A popular version of the open source Magento ecommerce platform is vulnerable Vulnerability-related.DiscoverVulnerability to a zero-day remote code execution vulnerability , putting as many as 200,000 online retailers at risk . The warning comes from security firm DefenseCode , which found Vulnerability-related.DiscoverVulnerability and originally reported Vulnerability-related.DiscoverVulnerability the vulnerability to Magento in November . “ During the security audit of Magento Community Edition , a high risk vulnerability was discovered Vulnerability-related.DiscoverVulnerability that could lead to remote code execution and thus the complete system compromise including the database containing sensitive customer information such as stored credit card numbers and other payment information , ” DefenseCode wrote in a technical description of its discovery ( PDF ) posted Wednesday . According Bosko Stankovic , information security engineer at DefenseCode , despite repeated efforts to notify Vulnerability-related.DiscoverVulnerability Magento , which began in November 2016 , the vulnerability remains unpatched Vulnerability-related.PatchVulnerability despite four version updates since the disclosure Vulnerability-related.DiscoverVulnerability . DefenseCode did not examine Magento Enterprise , the commercial version of the platform , but warns both share the same underlying vulnerable code . “ We ’ re unsure if this vulnerability is actively being exploited Vulnerability-related.DiscoverVulnerability in the wild , but since the vulnerability has been unpatched Vulnerability-related.PatchVulnerability for so long it provides a window of opportunity for potential hackers , ” Stankovic said . Magento confirmed the existence Vulnerability-related.DiscoverVulnerability of the flaw in a brief statement to Threatpost and said it was investigating . “ We have been actively investigating Vulnerability-related.DiscoverVulnerability the root cause of the reported issue and are not aware of any attacks in the wild . We will be addressing Vulnerability-related.PatchVulnerability the issue in our next patch release and continue to consistently work to improve our assurance processes , ” Magento said in a statement . Yesterday , Threatpost reported Vulnerability-related.DiscoverVulnerability a story about a remote code execution vulnerability with Magento 2 Enterprise and Community software . Magento is committed to delivering superior security to clients and has been actively investigating Vulnerability-related.DiscoverVulnerability the root cause of the reported issue . We are not aware of any attacks in the wild . Admin access is required to execute the exploit , so as always , we encourage you to follow best practices to keep your Admin secure . In addition , this vulnerability will be addressed Vulnerability-related.PatchVulnerability in our next release Vulnerability-related.PatchVulnerability targeted for early May . Until then , we recommend enforcing the use of “ Add Secret Key to URLs ” to mitigate potential attacks .