Skip to content

Commit 20eaa3c

Browse files
wubinworkswubinworks
authoredFeb 6, 2025
Merge pull request #3 from wubinworks/issue-1-php7-support
Support Magento 2.3 and PHP 7
·
1.2.0
2 parents 18d9de4 + be431cf commit 20eaa3c

File tree

7 files changed

+363
-86
lines changed

7 files changed

+363
-86
lines changed
 

‎Model/Exception/InvalidArgumentException.php

-14
This file was deleted.

‎Model/RequestInfo.php

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
<?php
2+
/**
3+
* Copyright © Wubinworks. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Wubinworks\CosmicStingPatch\Model;
9+
10+
use Laminas\Http\PhpEnvironment\RemoteAddress as LaminasHttpRemoteAddress;
11+
use Zend\Http\PhpEnvironment\RemoteAddress as ZendHttpRemoteAddress;
12+
use Magento\Framework\HTTP\PhpEnvironment\Request;
13+
14+
/**
15+
* Request information
16+
*/
17+
class RequestInfo
18+
{
19+
public const INFO_KEYS = [
20+
'ip',
21+
'request_line',
22+
'body'
23+
];
24+
25+
/**
26+
* @var Request
27+
*/
28+
protected $request;
29+
30+
/**
31+
* Constructor
32+
*
33+
* @param Request $request
34+
*/
35+
public function __construct(
36+
Request $request
37+
) {
38+
$this->request = $request;
39+
}
40+
41+
/**
42+
* Get request information
43+
*
44+
* @param ?string $key
45+
* @return string|string[]
46+
*
47+
* @throws \InvalidArgumentException
48+
*/
49+
public function getRequestInfo(?string $key = null)
50+
{
51+
$info = [
52+
'ip' => (string)$this->getRemoteAddress(), // `false` converted to empty string
53+
'request_line' => $this->getRequestLine(),
54+
'body' => $this->getRequestBody()
55+
];
56+
if ($key === null) {
57+
return $info;
58+
}
59+
if (!array_key_exists($key, $info)) {
60+
throw new \InvalidArgumentException(sprintf(
61+
'Unknown key %s was used to retrieve RequestInfo.',
62+
$key
63+
));
64+
}
65+
return $info[$key];
66+
}
67+
68+
/**
69+
* Get correct remote IP address
70+
*
71+
* @return string|bool `false` if failed
72+
*/
73+
protected function getRemoteAddress()
74+
{
75+
if (class_exists(LaminasHttpRemoteAddress::class)) {
76+
$httpRemoteAddressClass = LaminasHttpRemoteAddress::class;
77+
} else {
78+
$httpRemoteAddressClass = ZendHttpRemoteAddress::class;
79+
}
80+
81+
$ip = (new $httpRemoteAddressClass())->getIpAddress();
82+
if ($ip) {
83+
return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6);
84+
}
85+
86+
return false;
87+
}
88+
89+
/**
90+
* Get request line
91+
*
92+
* @return string
93+
*/
94+
protected function getRequestLine(): string
95+
{
96+
return (string)$this->request->renderRequestLine();
97+
}
98+
99+
/**
100+
* Get request body with limited length
101+
*
102+
* @param int $maxLength
103+
* @return string
104+
*/
105+
protected function getRequestBody(int $maxLength = 1000): string
106+
{
107+
return mb_substr((string)$this->request->getContent(), 0, $maxLength);
108+
}
109+
}

‎Model/Simplexml/Element.php

-54
This file was deleted.

‎Plugin/Framework/Webapi/ServiceInputProcessor.php

+164
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
<?php
2+
/**
3+
* Copyright © Wubinworks. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Wubinworks\CosmicStingPatch\Plugin\Framework\Webapi;
9+
10+
use Magento\Framework\Phrase;
11+
use Magento\Framework\Exception\SerializationException;
12+
use Wubinworks\CosmicStingPatch\Model\RequestInfo;
13+
14+
/**
15+
* Patch for CVE-2024-34102(aka Cosmic Sting)
16+
*
17+
* @link https://nvd.nist.gov/vuln/detail/CVE-2024-34102
18+
* @link https://helpx.adobe.com/security/products/magento/apsb24-40.html
19+
* @link https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/security-update-available-for-adobe-commerce-apsb24-40-revised-to-include-isolated-patch-for-cve-2024-34102
20+
*/
21+
class ServiceInputProcessor
22+
{
23+
/**
24+
* Including inherited classes
25+
*
26+
* @var string[]
27+
*/
28+
protected $forbiddenClasses = [
29+
\SimpleXMLElement::class,
30+
\DOMElement::class
31+
];
32+
33+
/**
34+
* @var RequestInfo
35+
*/
36+
protected $requestInfo;
37+
38+
/**
39+
* @var \Psr\Log\LoggerInterface
40+
*/
41+
protected $logger;
42+
43+
/**
44+
* @var array
45+
*/
46+
protected $loggerConfig;
47+
48+
/**
49+
* Constructor
50+
*
51+
* @param RequestInfo $requestInfo
52+
* @param \Psr\Log\LoggerInterface $logger
53+
* @param array $loggerConfig
54+
*/
55+
public function __construct(
56+
RequestInfo $requestInfo,
57+
\Psr\Log\LoggerInterface $logger,
58+
array $loggerConfig = []
59+
) {
60+
$this->requestInfo = $requestInfo;
61+
$this->logger = $logger;
62+
$this->loggerConfig = array_merge($this->_initLoggerConfig(), $loggerConfig);
63+
}
64+
65+
/**
66+
* Before plugin to detect forbidden type
67+
*
68+
* @param \Magento\Framework\Webapi\ServiceInputProcessor $subject
69+
* @param mixed $data
70+
* @param string $type
71+
* @return null
72+
*
73+
* @throws SerializationException
74+
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
75+
*/
76+
public function beforeConvertValue(
77+
\Magento\Framework\Webapi\ServiceInputProcessor $subject,
78+
$data,
79+
$type
80+
) {
81+
$type = (string)$type;
82+
if ($this->isForbiddenType($type)) {
83+
$message = $this->prepareLogMessage();
84+
if ($message) {
85+
$this->logger->info($message);
86+
}
87+
throw new SerializationException(
88+
new Phrase('Invalid data type detected in deserialization process.')
89+
);
90+
}
91+
92+
return null;
93+
}
94+
95+
/**
96+
* Check forbidden type
97+
*
98+
* @param string $type
99+
* @return bool
100+
*/
101+
protected function isForbiddenType(string $type): bool
102+
{
103+
foreach ($this->forbiddenClasses as $forbiddenClass) {
104+
if (is_subclass_of($type, $forbiddenClass)) {
105+
return true;
106+
}
107+
}
108+
return false;
109+
}
110+
111+
/**
112+
* Prepare log message
113+
*
114+
* @return string
115+
*/
116+
protected function prepareLogMessage(): string
117+
{
118+
if (!$this->isLoggerEnabled()) {
119+
return '';
120+
}
121+
122+
$message = 'Detected possible Cosmic Sting attack.' . "\n";
123+
if ($this->loggerConfig['ip']['enabled']) {
124+
$message .= 'IP: ' . $this->requestInfo->getRequestInfo('ip') . "\n";
125+
}
126+
if ($this->loggerConfig['request_line']['enabled']) {
127+
$message .= $this->requestInfo->getRequestInfo('request_line') . "\n";
128+
}
129+
if ($this->loggerConfig['body']['enabled']) {
130+
$message .= $this->requestInfo->getRequestInfo('body') . "\n";
131+
}
132+
133+
return $message;
134+
}
135+
136+
/**
137+
* Initialize logger config
138+
*
139+
* @return array
140+
*/
141+
protected function _initLoggerConfig(): array
142+
{
143+
$result = [];
144+
foreach (RequestInfo::INFO_KEYS as $key) {
145+
$result[$key]['enabled'] = false;
146+
}
147+
return $result;
148+
}
149+
150+
/**
151+
* Check logger enabled
152+
*
153+
* @return bool
154+
*/
155+
protected function isLoggerEnabled(): bool
156+
{
157+
foreach ($this->loggerConfig as $item) {
158+
if ($item['enabled']) {
159+
return true;
160+
}
161+
}
162+
return false;
163+
}
164+
}

‎README.md

+67-14
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
# Magento 2 patch for CVE-2024-34102(aka Cosmic Sting)
1+
# Magento 2 Patch for CVE-2024-34102(aka Cosmic Sting)
22

3-
**Another way(as an extension) to fix CVE-2024-34102(XXE vulnerability) with extra XML Security enhancement. If you cannot upgrade Magento or cannot apply the official patch, this one is an alternative solution.**
3+
**An alternative solution(as a Magento 2 extension) to fix the XXE vulnerability CVE-2024-34102(aka Cosmic Sting). If you cannot upgrade Magento or cannot apply the official patch, try this one.**
44

55
**_If you don't fix this vulnerability, the attacker can RCE. We've already observed real world attacks._**
66

7-
[![Magento 2 patch for CVE-2024-34102(aka Cosmic Sting)](https://raw.githubusercontent.com/wubinworks/home/master/images/Wubinworks/CosmicStingPatch/cosmic-sting-patch-v1.1.jpg "Magento 2 patch for CVE-2024-34102(aka Cosmic Sting)")](https://www.wubinworks.com/cosmic-sting-patch.html)
7+
[![Magento 2 CVE-2024-34102(aka Cosmic Sting) Patch](https://raw.githubusercontent.com/wubinworks/home/master/images/Wubinworks/CosmicStingPatch/cosmic-sting-patch-v1.1.jpg "Magento 2 CVE-2024-34102(aka Cosmic Sting) Patch")](https://www.wubinworks.com/cosmic-sting-patch.html)
88

99
## CVE-2024-34102 Affected Magento Versions(starting from 2.3)
1010

@@ -15,7 +15,7 @@
1515

1616
## Background
1717

18-
[CVE-2024-34102](https://cve.org/CVERecord?id=CVE-2024-34102)(aka Cosmic Sting) was identified as XXE vulnerability and the details were published on June 2024. By exploiting this vulnerability, the attacker can read secret and important configuration files on the server.
18+
[CVE-2024-34102](https://cve.org/CVERecord?id=CVE-2024-34102)(aka Cosmic Sting) was identified as [XXE](https://en.wikipedia.org/wiki/XML_external_entity_attack) vulnerability and the details were published on June 2024. By exploiting this vulnerability, the attacker can read secret and important configuration files on the server.
1919
Typically, the attacker will extract encryption keys in `env.php`.
2020

2121
In most hacked servers, we observed one or multiple of the followings:
@@ -25,7 +25,7 @@ In most hacked servers, we observed one or multiple of the followings:
2525
- Backdoors
2626
- Magento core files modified
2727
- PHP script that steals sales data
28-
- Inject Javascript to CMS pages to steal credit cards
28+
- Inject malicious Javascript to CMS pages to steal credit cards
2929
- And maybe more
3030

3131
If you want to know _"How Exactly It Works"_, we have very detailed blog posts that [examine](https://www.wubinworks.com/blog/post/cve-2024-34102-cosmic-sting-attack) and [fix](https://www.wubinworks.com/blog/post/cve-2024-34102-aka-cosmicsting-how-to-defend) the vulnerability.
@@ -38,20 +38,20 @@ The attacker can craft fake Admin Token by using the stolen encryption key. With
3838

3939
### Chained with CVE-2024-2961
4040

41-
> XXEs are now RCEs
41+
> XXEs are now RCEs.
4242
4343
As CVE-2024-34102 enables the ability to read arbitrary file on the server, the attacker can now combine it with a bug([CVE-2024-2961](https://www.cve.org/CVERecord?id=CVE-2024-2961)) discovered in `glibc` to run any command on the server. One real case we experienced was that multiple backdoors got downloaded and installed.
4444
The `glibc` bug exists in `glibc` version <= 2.3.9
4545

4646
##### Check `glibc` version by running
4747

48-
```
48+
```bash
4949
ldd --version | grep -i 'libc'
5050
```
5151

5252
## How to fix?
5353

54-
### Fix CVE-2024-34102
54+
### Fix the Main Vulnerability CVE-2024-34102
5555

5656
There are 3 Ways Available:
5757

@@ -66,7 +66,7 @@ There are 3 Ways Available:
6666
This step invalidates crafted fake tokens to completely deny WebAPI access from attacker.
6767
_If you are unsure whether encryption keys are leaked or not, do this step._
6868

69-
##### More Info
69+
##### Additional Info
7070

7171
Some Magento 2.4 versions have a bug that you need to apply a [patch](https://github.com/wubinworks/magento2-jwt-auth-patch) before performing key rotation.
7272

@@ -76,26 +76,79 @@ Some Magento 2.4 versions have a bug that you need to apply a [patch](https://gi
7676

7777
[New Magento encryption key format](https://www.wubinworks.com/blog/post/new-encryption-key-format-introduced-on-magento-2.4.7)
7878

79-
### Fix `glibc` Bug(Highly Recommended)
79+
### Fix `glibc` Bug(Strongly Recommended)
8080

8181
Update `glibc` to >= 2.40 to fix CVE-2024-2961.
8282

83+
_Don't forget to reboot server._
84+
85+
## Feature
86+
87+
This extension
88+
89+
- Fixes CVE-2024-34102(Can PASS the [Official Security Scan Tool](https://account.magento.com/scanner/dashboard/))
90+
- Version 1.2.0 new feature: _Who Attacked My Site_
91+
For those who are interested in the attacker, check [Logging](#logging) section.
92+
93+
## Logging
94+
95+
##### Enable Logging
96+
97+
By default, logging is disabled for performance consideration. To enable, open a local module and merge the following to `etc/di.xml`.
98+
99+
```xml
100+
<?xml version="1.0"?>
101+
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
102+
xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
103+
<type name="Wubinworks\CosmicStingPatch\Plugin\Framework\Webapi\ServiceInputProcessor">
104+
<arguments>
105+
<argument name="loggerConfig" xsi:type="array">
106+
<item name="ip" xsi:type="array">
107+
<item name="enabled" xsi:type="boolean">true</item>
108+
</item>
109+
</argument>
110+
</arguments>
111+
</type>
112+
</config>
113+
```
114+
115+
##### Log Location
116+
117+
```text
118+
<magento_root>/var/log/wubinworks_cve-2024-34102.log
119+
```
120+
121+
##### Incorrect IP Address?
122+
123+
If you got incorrect IP such as `127.0.0.1`, empty string or a CDN's IP, this means your ***web server, middleware, and/or proxy server have incorrect settings***. There is no way to tell the real IP address without fixing those incorrect settings.
124+
83125
## Requirements
84126

85-
Magento 2.3
86-
Magento 2.4
127+
Magento 2.3 or 2.4
128+
129+
##### PHP Version Compatibility
130+
131+
Version 1.0.0 and 1.1.0 support PHP 8 only
132+
Version 1.2.0(re-designed) supports PHP 7 and PHP 8
87133

88134
## Installation
89135

136+
Latest:
90137
**`composer require wubinworks/module-cosmic-sting-patch`**
91138

92-
_This extension requires dependencies that are not included in default Magento installation, so you need to use `composer`._
139+
Installation Tips:
140+
- _Version 1.0.0 and 1.1.0 must be installed via `composer`_
141+
- _Version 1.2.0 can be installed via `composer` or directly to `app/code`_
93142

94143
## ♥
95144

96145
If you like this extension or this extension helped you, please ★star☆ this repository.
97146

98147
You may also like:
99-
[Magento 2 patch for CVE-2022-24086, CVE-2022-24087](https://github.com/wubinworks/magento2-template-filter-patch)
148+
[Magento 2 Patch for CVE-2022-24086, CVE-2022-24087](https://github.com/wubinworks/magento2-template-filter-patch)
149+
[Magento 2 Enhanced XML Security](https://github.com/wubinworks/magento2-enhanced-xml-security)
150+
[Magento 2 Encryption Key Manager CLI](https://github.com/wubinworks/magento2-encryption-key-manager-cli)
151+
[Magento 2 JWT Authentication Patch](https://github.com/wubinworks/magento2-jwt-auth-patch)
152+
100153
[Magento 2 Disable Customer Change Email Extension](https://github.com/wubinworks/disable-change-email)
101154
[Magento 2 Disable Customer Extension](https://github.com/wubinworks/magento2-disable-customer)

‎composer.json

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "wubinworks/module-cosmic-sting-patch",
3-
"description": "Another way(as an extension) to fix CVE-2024-34102(XXE vulnerability) with extra XML Security enhancement. If you cannot upgrade Magento or cannot apply the official patch, this one is an alternative solution.",
3+
"description": "An alternative solution(as a Magento 2 extension) to fix the XXE vulnerability CVE-2024-34102(aka Cosmic Sting). If you cannot upgrade Magento or cannot apply the official patch, try this one.",
44
"keywords": [
55
"cve-2024-34102",
66
"cosmic sting",
@@ -20,11 +20,10 @@
2020
},
2121
"require": {
2222
"php": ">=7.1",
23-
"wubinworks/module-xml-security": "^1.0.1",
2423
"magento/magento2-base": "~2.3.0 || ~2.4.0"
2524
},
2625
"type": "magento2-module",
27-
"version": "1.1.0",
26+
"version": "1.2.0",
2827
"license": "OSL-3.0",
2928
"authors": [
3029
{

‎etc/di.xml

+21-1
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,25 @@
77
-->
88
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
99
xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
10-
<preference for="Magento\Framework\Simplexml\Element" type="Wubinworks\CosmicStingPatch\Model\Simplexml\Element" />
10+
<type name="Magento\Framework\Webapi\ServiceInputProcessor">
11+
<plugin name="wubinworks_cosmicstingpatch_plugin_framework_webapi_serviceinputprocessor" type="Wubinworks\CosmicStingPatch\Plugin\Framework\Webapi\ServiceInputProcessor" />
12+
</type>
13+
<virtualType name="Wubinworks\CosmicStingPatch\Model\Logger\Handler\Debug" type="Magento\Framework\Logger\Handler\Base">
14+
<arguments>
15+
<argument name="fileName" xsi:type="string">var/log/wubinworks_cve-2024-34102.log</argument>
16+
</arguments>
17+
</virtualType>
18+
<virtualType name="Wubinworks\CosmicStingPatch\Model\Logger\Debug" type="Magento\Framework\Logger\Monolog">
19+
<arguments>
20+
<argument name="name" xsi:type="string">CVE-2024-34102</argument>
21+
<argument name="handlers" xsi:type="array">
22+
<item name="system" xsi:type="object">Wubinworks\CosmicStingPatch\Model\Logger\Handler\Debug</item>
23+
</argument>
24+
</arguments>
25+
</virtualType>
26+
<type name="Wubinworks\CosmicStingPatch\Plugin\Framework\Webapi\ServiceInputProcessor">
27+
<arguments>
28+
<argument name="logger" xsi:type="object">Wubinworks\CosmicStingPatch\Model\Logger\Debug</argument>
29+
</arguments>
30+
</type>
1131
</config>

0 commit comments

Comments
 (0)
Please sign in to comment.