1. Introduction
2. Technical Explanation
The vulnerability exists due to insufficient input validation in the prefix parameter of the /magmi/web/ajax_gettime.php URL. An attacker can inject HTML or JavaScript code through this parameter, which is then executed within the context of a vulnerable application user’s browser session. This allows for remote execution of arbitrary scripts.
- Root cause: Missing input validation on the ‘prefix’ parameter in /magmi/web/ajax_gettime.php
- Exploit mechanism: An attacker crafts a malicious URL containing JavaScript code within the prefix parameter and tricks a user into visiting it. For example,
http://example.com/magmi/web/ajax_gettime.php?prefix= - Scope: Magento Mass Importer versions prior to 0.7.23.
3. Detection and Assessment
To confirm vulnerability, check the installed version of Magento Mass Importer. Thorough assessment involves reviewing web server logs for suspicious requests containing JavaScript code in the prefix parameter.
- Quick checks: Check the Magmi version using the UI or by examining the Magmi installation directory.
- Scanning: Burp Suite or OWASP ZAP can be used to scan for XSS vulnerabilities, but may require configuration and testing.
- Logs and evidence: Examine web server access logs for requests to /magmi/web/ajax_gettime.php containing the ‘prefix’ parameter with suspicious characters like <script>.
# No specific command available, check Magmi version via UI or installation directory.4. Solution / Remediation Steps
The recommended solution is to remove the software as the 0.7.23 release has known issues.
4.1 Preparation
- There are no dependencies, but ensure you have access to restore backups. Change windows may be needed for larger installations.
4.2 Implementation
- Step 1: Delete the Magmi installation directory and all associated files.
4.3 Config or Code Example
No config or code example is applicable as the solution involves removing the software.
4.4 Security Practices Relevant to This Vulnerability
Input validation is crucial for preventing XSS attacks. Least privilege can limit the impact of a successful exploit by restricting user permissions. A patch cadence ensures timely application of security updates.
- Practice 1: Input validation – Validate all user-supplied input to prevent malicious code injection.
- Practice 2: Least privilege – Grant users only the minimum necessary permissions required for their tasks.
4.5 Automation (Optional)
No automation is applicable as the solution involves removing the software.
5. Verification / Validation
Confirm that the Magmi installation directory has been removed and no longer exists. Re-test by attempting to access the /magmi/web/ajax_gettime.php URL, which should return a 404 error. Verify core Magento functionality remains operational.
- Post-fix check: Attempting to access /magmi/web/ajax_gettime.php should result in a 404 Not Found error.
- Re-test: Scanning for the vulnerability using Burp Suite or OWASP ZAP should no longer detect the XSS issue.
- Smoke test: Verify core Magento functions such as product browsing, adding items to cart, and checkout are still working correctly.
# No specific command available, verify 404 error via web browser.6. Preventive Measures and Monitoring
- Baselines: Update your Magento security baseline to reflect the removal of vulnerable software.
- Pipelines: Integrate SAST tools into your CI/CD pipeline to scan code for XSS vulnerabilities.
- Asset and patch process: Review and apply patches for all third-party components on a regular basis (e.g., monthly).
7. Risks, Side Effects, and Roll Back
Removing Magmi will disable any functionality that relies on it. Ensure you have alternative methods for performing bulk operations if needed. To roll back, restore the Magmi installation directory from your backup.
- Risk or side effect 1: Loss of bulk import/export functionality provided by Magmi. Mitigation: Implement an alternative solution for these tasks.
- Roll back: Restore the Magmi installation directory and files from the pre-removal backup. Restart web services if necessary.
8. References and Resources
Official advisories and trusted documentation related to this vulnerability.
- Vendor advisory or bulletin: https://github.com/dweeves/magmi-git/issues/522
- NVD or CVE entry: CVE-2017-7391
- Product or platform documentation relevant to the fix: https://www.documentcloud.org/documents/6893935-FBI-Flash-Alert-MU-000127-MW.html