Tech,Space,Gaming, and Science Fiction News to wet your whistle
Magento Patches Command Execution, Local File Read Flaws
Magento recently addressed two vulnerabilities that could lead to command execution and local file read, a SCRT security researcher reveals.
Written in PHP, Magento is a popular open-source e-commerce platform that is part of Adobe Experience Cloud. Vulnerabilities in Magento – and any other popular content management systems out there – are valuable to malicious actors, as they could be exploited to impact a large number of users.
In September last year, SCRT's Daniel Le Gall found two vulnerabilities in Magento, both of which could be exploited with low privileges admin accounts, which are usually provided to Marketing users.
The first of the two security bugs is a command execution using path traversal. Exploitation, the researchers reveal, requires the user to be able to create products. The second issue is a local file read that requires the user to be able to create email templates.
The root cause of the first issue is a path traversal, whichLe Gall discoveredin a function that checks if a file that templates can be loaded from is located in certain directories. The faulty function only checks if the provided path begins by a specific directory name, but not if the resolved path is in the whitelisted directories.
Because of the partial checks performed by the function, a path traversal can be called through a Product Design, but only to process .phtml files as PHP code.
Although this is a forbidden extension on most upload forms, one could create a file with "Custom Options," and could allow extensions they want to be uploaded, including phtml. Once ordered, the item is stored to a specific .extension, which allows for command execution, the researcher says.
The second vulnerability was found in email templating, which allows the use of a special directive to load the content of a CSS file into the email. The two functions that are managing this directive are not checking for path traversal characters anywhere and an attacker could inject any file into the email template.
"Creating an email template with the should be sufficient to trigger the vulnerability,"Le Gall says.
The researcher disclosed both of these vulnerabilities in September last year, and a patch released at the end of November (Magento 2.2.7 and 2.1.16 released) addressed both of them. The researcher was awarded a total of $7500 in bug bounty rewards for the findings.
By Liam McCabe This post was done in partnership with Wirecutter . When readers choose to buy Wirecutter's independently chosen editorial picks, it may earn affiliate commissions that support its work. Read the full article here . After six summers of researching, testing, and recommending window air conditioners, we've learned that quiet and affordable ACs make most people the happiest—and we think the LG LW8016ER will fit the bill in most rooms. This 8,000 Btu unit cools as efficiently and effectively as any model with an equal Btu rating, and runs at a lower volume and deeper pitch than others at this price. Little extra features like a fresh-air vent, two-axis fan blades, and a removable drain plug help set it apart, too. The LG LW8016ER is a top choice for an office or den, and some people will find it quiet enough for a bedroom, too. If our main pic
Google has been regularly adding new language support to Gboard , its popular keyboard for iOS and Android. Today, it updated the Android version of its keyboard app with 18 new languages, according to the changelog. You can see the full list of languages the app now supports over at Google Support (over 400!) and download the app from the Google Play store . However, Android Police notes that, when looking at the Google Support list, it could only find 16 new languages or language varieties. These are: Arabic (Gulf) Buryat (Mongolia) Buryat (Russia) Cornish Gondi (Devanagari) Greek (Cyprus) Hakka Hausa (Ghana) Khorasani Turkic (Arabic) Lower Sorbian Mandeali Mundari (Bengali) Portuguese (Macau) Shekhawati Siberian Tatar Talysh (Russia). Additional changes include Japanese support for Android TV
Cuando llevas miles de horas gestionando entornos vSphere, es posible que te encuentres con situaciones o problemas extraños con tus VMs, como es el caso de este post, donde veremos... Leer más » La entrada Forzar el reinicio de una VM que no responde en vSphere aparece primero en Blog de Cenabit . via Latest imported feed items on VMware Blogs https://ift.tt/2OIPfR4 If New feed item from https://blogs.vmware.com/feed , then send me an email at kr