Article Details
Scrape Timestamp (UTC): 2024-04-06 09:49:01.659
Source: https://thehackernews.com/2024/04/hackers-exploit-magento-bug-to-steal.html
Original Article Text
Click to Toggle View
Hackers Exploit Magento Bug to Steal Payment Data from E-commerce Websites. Threat actors have been found exploiting a critical flaw in Magento to inject a persistent backdoor into e-commerce websites. The attack leverages CVE-2024-20720 (CVSS score: 9.1), which has been described by Adobe as a case of "improper neutralization of special elements" that could pave the way for arbitrary code execution. It was addressed by the company as part of security updates released on February 13, 2024. Sansec said it discovered a "cleverly crafted layout template in the database" that's being used to automatically inject malicious code to execute arbitrary commands. "Attackers combine the Magento layout parser with the beberlei/assert package (installed by default) to execute system commands," the company said. "Because the layout block is tied to the checkout cart, this command is executed whenever <store>/checkout/cart is requested." The command in question is sed, which is used to insert a code execution backdoor that's then responsible for delivering a Stripe payment skimmer to capture and exfiltrate financial information to another compromised Magento store. The development comes as the Russian government has charged six people for using skimmer malware to steal credit card and payment information from foreign e-commerce stores at least since late 2017. The suspects are Denis Priymachenko, Alexander Aseyev, Alexander Basov, Dmitry Kolpakov, Vladislav Patyuk, and Anton Tolmachev. Recorded Future News reported that the arrests were made a year ago, citing court documents. "As a result, members of the hacker group illegally took possession of information about almost 160 thousand payment cards of foreign citizens, after which they sold them through shadow internet sites," the Prosecutor General's Office of the Russian Federation said. The Strategic Guide to Cloud Security Unlock practical steps to securing everything you build and run in the cloud. Goodbye, Atlassian Server. Goodbye… Backups? Protect your data on Atlassian Cloud from disaster with Rewind's daily backups and on-demand restores. How to Update and Automate Outdated Security Processes Download the eBook for step-by-step guidance on how to update your security processes as your business grows.
Daily Brief Summary
A critical security flaw, CVE-2024-20720, in Magento has been exploited to inject malicious code into e-commerce websites, allowing the theft of payment data.
Adobe acknowledged and patched the flaw, with a CVSS score of 9.1, on February 13, 2024, which allowed remote code execution through special elements.
The attackers used a layout feature in Magento combined with the beberlei/assert package to execute the 'sed' command and insert a backdoor.
When customers access the checkout cart on an infected store, the malicious block executes and deploys a Stripe payment skimmer.
The skimmer captures financial information and exfiltrates it to another compromised Magento store.
Separately, the Russian government has charged six individuals with stealing credit card data from foreign e-commerce stores using skimmer malware since 2017.
The cybercrime group captured information from nearly 160,000 payment cards and sold the data on dark web platforms.