search

magento / magento2

Prior to making any Submission(s), you must sign an Adobe Contributor License Agreement, available here at: https://opensource.adobe.com/cla.html. All Submissions you make to Adobe Inc. and its affiliates, assigns and subsidiaries (collectively “Adobe”) are subject to the terms of the Adobe Contributor License Agreement.
http://www.magento.com
Open Software License 3.0
11.53k stars 9.31k forks source link

Spam BOT Registration Attack on form customer/account/createpost #18504

Closed gitgiangalbe closed 5 years ago

gitgiangalbe commented 6 years ago

Summary

My Magento 2.2.5 CE installation has been attacked with multiple fake account registration. on log (plesk registry function) i found a lot of double request, first in "GET" to "customer/account/create/" then in "POST" to "customer/account/createpost": probably the bot first made a "GET" request on form "customer/account/create/" in order to retrieve form-key and then the form "customer/account/createpost" to made a fake account registration. with this trick it avoided the captcha.

Examples

Proposed solution

I tried many solutions without success as RewriteCond in .htaccess (on Magento root) but doesn't work properly.

RewriteEngine On RewriteBase / RewriteCond %{REQUEST_METHOD} POST RewriteCond %{REQUEST_URI} ^/customer/account/createpost/$ RewriteCond %{HTTP_REFERER} !^http://www\.schoolshop\.it/customer/account/create/$ RewriteRule ^.* - [F,L]

Source: (https://stackoverflow.com/questions/47144150/preventing-spam-direct-post-request-customer-registrations-in-magento)

Its a really security problem... any suggestions ? Thanks.

magento-engcom-team commented 6 years ago

Hi @gitgiangalbe. Thank you for your report. To help us process this issue please make sure that you provided the following information:

Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:

@magento-engcom-team give me $VERSION instance

where $VERSION is version tags (starting from 2.2.0+) or develop branches (for example: 2.3-develop). For more details, please, review the Magento Contributor Assistant documentation.

@gitgiangalbe do you confirm that you was able to reproduce the issue on vanilla Magento instance following steps to reproduce?

gitgiangalbe commented 6 years ago

Hi @gitgiangalbe. Thank you for your report. To help us process this issue please make sure that you provided the following information:

  • [x] Summary of the issue
  • [x] Information on your environment
  • [x] Steps to reproduce
  • [x] Expected and actual results

Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:

@magento-engcom-team give me $VERSION instance

where $VERSION is version tags (starting from 2.2.0+) or develop branches (for example: 2.3-develop). For more details, please, review the Magento Contributor Assistant documentation.

@gitgiangalbe do you confirm that you was able to reproduce the issue on vanilla Magento instance following steps to reproduce?

  • [X ] yes
  • [ ] no
magento-engcom-team commented 5 years ago

Hi @TomashKhamlai. Thank you for working on this issue. In order to make sure that issue has enough information and ready for development, please read and check the following instruction: :point_down:

TomashKhamlai commented 5 years ago

Do you mean that it is enough to send first request

curl -X GET http://magento2.conf/customer/account/create/ | grep -in 'form_key'

and then second one?

boundary='---------------------------14754865515046044461496729708'
form_key='KXsMOZJmELZlaAPa'
firstname='John'
lastname='Doe'
email='johndoe@example.com'
password='R834jx3hDzx'
password_confirmation='R834jx3hDzx'

curl -X POST \
-H "Content-Type: multipart/form-data; boundary=$boundary" \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-H 'Accept-Encoding: gzip, deflate' \
-H 'User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0' \
-H 'Referer: http://magento2.conf/customer/account/create/' \
--data-binary "
--$boundary
Content-Disposition: form-data; name="form_key"

$form_key
--$boundary
Content-Disposition: form-data; name="firstname"

$firstname
--$boundary
Content-Disposition: form-data; name="lastname"

$lastname
--$boundary
Content-Disposition: form-data; name="email"

$email
--$boundary
Content-Disposition: form-data; name="password"

$password
--$boundary
Content-Disposition: form-data; name="password_confirmation"

$password_confirmation
--$boundary--" \
--compressed 'http://magento2.conf/customer/account/createpost/'

I tried with no success. @gitgiangalbe, do you have an idea how this could be done?

DanielRuf commented 5 years ago

I guess these are normal and automated user interactions by the spammers. You should block their network using its CIDR notation.

Do you have timestamps from the GET and POST request?

DanielRuf commented 5 years ago

Also in general it can be possibly that CSRF tokens can be used in a specific timeframe.

gitgiangalbe commented 5 years ago

@DanielRuf: Solution seem correct. Sys Admin block their network using CIDIR notation. Issue rise from early Magento 2 installation where form is not under captcha security. This Issue born from one new Magento 2 installation where input forms is not under captcha security and, for my forgetfulness i didn't block all ip except just one of mine.

gitgiangalbe commented 5 years ago

@TomashKhamlai : actually your example demonstrate that in not simple to hack magento 2 but probably technique used by the spammer is different or your example lack some variable. I suspect the attack indicated in the initial post becouse i found multiple request in access log ie identical pairs of requests and multiple fake account into the database

LiamKarlMitchell commented 5 years ago

The bots are unrelenting they exhaust CPU on php-fpm and mysql and cripple the server...

Blocking them via linux's IP Tables seems appropriate, cloud flare attack mode can help. A cloud flare firewall filter can also be great against this say if you serve a target audience in specific countries.

The spam attack somehow eats all CPU... I've put a Google Invisible recapatcha on the site as well which stopped the customer_entity table filling up but the spam attack seems to still cause a problem.

But why would something as simple as creating an account lead to so much CPU usage? Is there a query or code here that could be better optimized, or is it just the sheer volume of the attack?

If it helps anyone our last 24 hours Traffic that we know is fake (exclude perhaps some bots from the US for search engines)

China 53,336 Hong Kong 34,107 United States 12149 Russian Federation 533

DanielRuf commented 5 years ago

Blackfire can give you more insight. Also there are always multiple factors (disk, CPU, RAM, DB, network, shared vs dedicated hosting, ...).

DanielRuf commented 5 years ago

And there are special monitoring tools to show which processes eat the most resources (open handles, DB queries and connections, I/O, CPU usage per thread, ...).

LiamKarlMitchell commented 5 years ago

@DanielRuf Blackfire hmm, thanks for telling me of this tool it seems very nice, not sure about sending data to third party for profiling but I suppose if it strips sensitive info I guess it's okay.

DanielRuf commented 5 years ago

https://blackfire.io/integrations

Magento is an official partner.

ghost commented 5 years ago

HI @gitgiangalbe thank you for you report, i'm closing this as this is non-issue for magento core.