Hackers Exploit Magento Bug to Steal Payment Data from E-commerce Websites

Menace actors have been observed exploiting a critical flaw in Magento to inject a persistent backdoor into e-commerce web-sites.

The attack leverages CVE-2024-20720 (CVSS rating: 9.1), which has been explained by Adobe as a situation of “inappropriate neutralization of special factors” that could pave the way for arbitrary code execution.

It was resolved by the enterprise as component of security updates introduced on February 13, 2024.

Sansec mentioned it uncovered a “cleverly crafted format template in the database” that’s getting employed to quickly inject destructive code to execute arbitrary instructions.

“Attackers combine the Magento format parser with the beberlei/assert package deal (installed by default) to execute process commands,” the corporation said.

“Since the layout block is tied to the checkout cart, this command is executed every time /checkout/cart is requested.”

The command in query is sed, which is used to insert a code execution backdoor that is then responsible for delivering a Stripe payment skimmer to seize and exfiltrate financial data to an additional compromised Magento keep.

The enhancement will come as the Russian authorities has charged 6 people for using skimmer malware to steal credit rating card and payment information and facts from international e-commerce shops at minimum since late 2017.

The suspects are Denis Priymachenko, Alexander Aseyev, Alexander Basov, Dmitry Kolpakov, Vladislav Patyuk, and Anton Tolmachev. Recorded Upcoming Information reported that the arrests were designed a year back, citing court docket paperwork.

“As a outcome, associates of the hacker group illegally took possession of information and facts about pretty much 160 thousand payment cards of foreign citizens, just after which they marketed them via shadow internet websites,” the Prosecutor General’s Office of the Russian Federation reported.

Located this article exciting? Follow us on Twitter  and LinkedIn to go through much more special material we submit.

Some parts of this article are sourced from:
thehackernews.com