Closed gitgiangalbe closed 5 years ago
Hi @gitgiangalbe. Thank you for your report. To help us process this issue please make sure that you provided the following information:
Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:
@magento-engcom-team give me $VERSION instance
where $VERSION
is version tags (starting from 2.2.0+) or develop branches (for example: 2.3-develop).
For more details, please, review the Magento Contributor Assistant documentation.
@gitgiangalbe do you confirm that you was able to reproduce the issue on vanilla Magento instance following steps to reproduce?
Hi @gitgiangalbe. Thank you for your report. To help us process this issue please make sure that you provided the following information:
- [x] Summary of the issue
- [x] Information on your environment
- [x] Steps to reproduce
- [x] Expected and actual results
Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:
@magento-engcom-team give me $VERSION instance
where
$VERSION
is version tags (starting from 2.2.0+) or develop branches (for example: 2.3-develop). For more details, please, review the Magento Contributor Assistant documentation.@gitgiangalbe do you confirm that you was able to reproduce the issue on vanilla Magento instance following steps to reproduce?
- [X ] yes
- [ ] no
Hi @TomashKhamlai. Thank you for working on this issue. In order to make sure that issue has enough information and ready for development, please read and check the following instruction: :point_down:
[ ] 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).Details
If the issue has a valid description, the label Issue: Format is valid
will be added to the issue automatically. Please, edit issue description if needed, until label Issue: Format is valid
appears.
[ ] 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue. If the report is valid, add Issue: Clear Description
label to the issue by yourself.
[ ] 3. Add Component: XXXXX
label(s) to the ticket, indicating the components it may be related to.
[ ] 4. Verify that the issue is reproducible on 2.3-develop
branchDetails
- Add the comment @magento-engcom-team give me 2.3-develop instance
to deploy test instance on Magento infrastructure.
- If the issue is reproducible on 2.3-develop
branch, please, add the label Reproduced on 2.3.x
.
- If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!
[ ] 5. Verify that the issue is reproducible on 2.2-develop
branch. Details
- Add the comment @magento-engcom-team give me 2.2-develop instance
to deploy test instance on Magento infrastructure.
- If the issue is reproducible on 2.2-develop
branch, please add the label Reproduced on 2.2.x
[ ] 6. Add label Issue: Confirmed
once verification is complete.
[ ] 7. Make sure that automatic system confirms that report has been added to the backlog.
Do you mean that it is enough to send first request
curl -X GET http://magento2.conf/customer/account/create/ | grep -in 'form_key'
and then second one?
boundary='---------------------------14754865515046044461496729708'
form_key='KXsMOZJmELZlaAPa'
firstname='John'
lastname='Doe'
email='johndoe@example.com'
password='R834jx3hDzx'
password_confirmation='R834jx3hDzx'
curl -X POST \
-H "Content-Type: multipart/form-data; boundary=$boundary" \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-H 'Accept-Encoding: gzip, deflate' \
-H 'User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0' \
-H 'Referer: http://magento2.conf/customer/account/create/' \
--data-binary "
--$boundary
Content-Disposition: form-data; name="form_key"
$form_key
--$boundary
Content-Disposition: form-data; name="firstname"
$firstname
--$boundary
Content-Disposition: form-data; name="lastname"
$lastname
--$boundary
Content-Disposition: form-data; name="email"
$email
--$boundary
Content-Disposition: form-data; name="password"
$password
--$boundary
Content-Disposition: form-data; name="password_confirmation"
$password_confirmation
--$boundary--" \
--compressed 'http://magento2.conf/customer/account/createpost/'
I tried with no success. @gitgiangalbe, do you have an idea how this could be done?
I guess these are normal and automated user interactions by the spammers. You should block their network using its CIDR notation.
Do you have timestamps from the GET and POST request?
Also in general it can be possibly that CSRF tokens can be used in a specific timeframe.
@DanielRuf: Solution seem correct. Sys Admin block their network using CIDIR notation. Issue rise from early Magento 2 installation where form is not under captcha security. This Issue born from one new Magento 2 installation where input forms is not under captcha security and, for my forgetfulness i didn't block all ip except just one of mine.
@TomashKhamlai : actually your example demonstrate that in not simple to hack magento 2 but probably technique used by the spammer is different or your example lack some variable. I suspect the attack indicated in the initial post becouse i found multiple request in access log ie identical pairs of requests and multiple fake account into the database
The bots are unrelenting they exhaust CPU on php-fpm and mysql and cripple the server...
Blocking them via linux's IP Tables seems appropriate, cloud flare attack mode can help. A cloud flare firewall filter can also be great against this say if you serve a target audience in specific countries.
The spam attack somehow eats all CPU... I've put a Google Invisible recapatcha on the site as well which stopped the customer_entity table filling up but the spam attack seems to still cause a problem.
But why would something as simple as creating an account lead to so much CPU usage? Is there a query or code here that could be better optimized, or is it just the sheer volume of the attack?
If it helps anyone our last 24 hours Traffic that we know is fake (exclude perhaps some bots from the US for search engines)
China 53,336 Hong Kong 34,107 United States 12149 Russian Federation 533
Blackfire can give you more insight. Also there are always multiple factors (disk, CPU, RAM, DB, network, shared vs dedicated hosting, ...).
And there are special monitoring tools to show which processes eat the most resources (open handles, DB queries and connections, I/O, CPU usage per thread, ...).
@DanielRuf Blackfire hmm, thanks for telling me of this tool it seems very nice, not sure about sending data to third party for profiling but I suppose if it strips sensitive info I guess it's okay.
https://blackfire.io/integrations
Magento is an official partner.
HI @gitgiangalbe thank you for you report, i'm closing this as this is non-issue for magento core.
Summary
My Magento 2.2.5 CE installation has been attacked with multiple fake account registration. on log (plesk registry function) i found a lot of double request, first in "GET" to "customer/account/create/" then in "POST" to "customer/account/createpost": probably the bot first made a "GET" request on form "customer/account/create/" in order to retrieve form-key and then the form "customer/account/createpost" to made a fake account registration. with this trick it avoided the captcha.
Examples
Proposed solution
I tried many solutions without success as RewriteCond in .htaccess (on Magento root) but doesn't work properly.
RewriteEngine On RewriteBase / RewriteCond %{REQUEST_METHOD} POST RewriteCond %{REQUEST_URI} ^/customer/account/createpost/$ RewriteCond %{HTTP_REFERER} !^http://www\.schoolshop\.it/customer/account/create/$ RewriteRule ^.* - [F,L]
Source: (https://stackoverflow.com/questions/47144150/preventing-spam-direct-post-request-customer-registrations-in-magento)
Its a really security problem... any suggestions ? Thanks.