Security News > 2020 > September > Magento Sites Vulnerable to RCE Stemming From Magmi Plugin Flaws
Satnam Narang, staff research engineer at Tenable, told Threatpost that researchers can't definitively say how many Magento sites are vulnerable - however, they were able to identify at least 1,500 websites indexed through search engines that use the Magmi plugin.
The second, now patched flaw, CVE-2020-5777, is an authentication bypass flaw in Magmi for Magento version 0.7.23 and below.
If the connection to the Magento database fails, Magmi will accept default credentials, which are magmi:magmi.
An FBI flash security alert that became public in May 2020 regarding in-the-wild exploitation of CVE-2017-7391, a cross-site scripting vulnerability in Magmi that was used to target vulnerable Magento sites.
In 2018, attackers used a few IP addresses to scan for vulnerable versions of Magmi.
News URL
https://threatpost.com/magento-sites-vulnerable-to-rce-stemming-from-magmi-plugin-flaws/158864/
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-09-01 | CVE-2020-5777 | Improper Authentication vulnerability in Magmi Project Magmi MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. | 9.8 |
| 2017-04-01 | CVE-2017-7391 | Cross-site Scripting vulnerability in Magmi Project Magmi 0.7.22 A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. | 6.1 |