Magento Security Patch – What is Patched in SUPEE-6482?

magento-1.9patchesSecurity

Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are the possible attacks that could affect and unpatched shop?
What 's the worst that could happen?

Update: I just wanted to add the email magento sent today to complete the post.
Magento Email Update

Best Answer

The actual security patch (SUPEE-6482) only affects the two following files and is an API patch.

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php
app/code/core/Mage/Catalog/Model/Product/Api/V2.php

The full 1.9.2.1 install is a different matter altogether. I would diff source code between 1.9.2.0 and 1.9.2.1 to figure out the other two items that were patched.

Release notes are for the full installer, you have to check the patch to see if it actually includes all the items noted in the release notes.

Implications of running an unpatched server:

  1. Cross-site Scripting Using Unvalidated Headers => Cache Poisoning
  2. Autoloaded File Inclusion in Magento SOAP API => Remote code autoload
  3. XSS in Gift Registry Search => Cookie theft and user impersonation
  4. SSRF Vulnerability in WSDL File => Internal server info leak and remote file inclusion

NOTE: Files patched in the full install archive that are not patched with the patch, hmm?

diff -r magento-1920/app/code/core/Mage/Core/Controller/Request/Http.php magento-1921/app/code/core/Mage/Core/Controller/Request/Http.php
300a301
>         $host = $_SERVER['HTTP_HOST'];
302,303c303,304
<             $host = explode(':', $_SERVER['HTTP_HOST']);
<             return $host[0];
---
>             $hostParts = explode(':', $_SERVER['HTTP_HOST']);
>             $host =  $hostParts[0];
305c306,313
<         return $_SERVER['HTTP_HOST'];
---
> 
>         if (strpos($host, ',') !== false || strpos($host, ';') !== false) {
>             $response = new Zend_Controller_Response_Http();
>             $response->setHttpResponseCode(400)->sendHeaders();
>             exit();
>         }
> 
>         return $host;

diff -r magento-1920/app/design/frontend/base/default/template/page/js/cookie.phtml magento-1921/app/design/frontend/base/default/template/page/js/cookie.phtml
37,38c37,38
< Mage.Cookies.path     = '<?php echo $this->getPath()?>';
< Mage.Cookies.domain   = '<?php echo $this->getDomain()?>';
---
> Mage.Cookies.path     = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getPath()) ?>';
> Mage.Cookies.domain   = '<?php echo Mage::helper('core')->jsQuoteEscape($this->getDomain()) ?>';
Related Topic