Menace actors have been discovered exploiting a important flaw in Magento to inject a persistent backdoor into e-commerce web sites.
The assault leverages CVE-2024-20720 (CVSS rating: 9.1), which has been described by Adobe as a case of “improper neutralization of special elements” that might pave the way in which for arbitrary code execution.
It was addressed by the corporate as a part of safety updates launched on February 13, 2024.
Sansec stated it found a “cleverly crafted layout template in the database” that is getting used to robotically inject malicious code to execute arbitrary instructions.
“Attackers combine the Magento layout parser with the beberlei/assert package (installed by default) to execute system commands,” the corporate stated.
“Because the layout block is tied to the checkout cart, this command is executed whenever <store>/checkout/cart is requested.”
The command in query is sed, which is used to insert a code execution backdoor that is then liable for delivering a Stripe fee skimmer to seize and exfiltrate monetary data to a different compromised Magento retailer.
The event comes because the Russian authorities has charged six folks for utilizing skimmer malware to steal bank card and fee data from overseas e-commerce shops at the least since late 2017.
The suspects are Denis Priymachenko, Alexander Aseyev, Alexander Basov, Dmitry Kolpakov, Vladislav Patyuk, and Anton Tolmachev. Recorded Future Information reported that the arrests have been made a 12 months in the past, citing courtroom paperwork.
“As a result, members of the hacker group illegally took possession of information about almost 160 thousand payment cards of foreign citizens, after which they sold them through shadow internet sites,” the Prosecutor Normal’s Workplace of the Russian Federation stated.
