jeroenvermeulen
commented
5 years ago @Rolandwalraven Can you share the IP blacklist we use? Can you request to add these IPs? (sorry a bit offtopic)
Open gwillem opened 5 years ago
jeroenvermeulen
commented
5 years ago @Rolandwalraven Can you share the IP blacklist we use? Can you request to add these IPs? (sorry a bit offtopic)
gwillem
commented
5 years ago No worries, I am maintaining an internal blacklist too, but still undecided whether I should use single IPs, class C netblocks or AS numbers. For OVH, a single IP is probably the best, but for Worldstream, I don't trust the whole ASN.
jeroenvermeulen
commented
5 years ago The IP blacklist we use is dnsbl.dronebl.org, more info https://dronebl.org/
Did find no easy way to add those IPs to that blacklist.
gwillem
commented
5 years ago And more probes, all from 137.74.21.194 who started probing in May 2018 and continued to Dec 2018.
/advancedreports/chart/tunnel
/ajaxproducts/index/index
/campaigner/abandoned/restore
/comm/message/crqu
/comm/returns/configureproduct
/customerconnect/rfqs/configureproduct
/emaildirect/abandoned/restore
/freegift/cart/gurlgift
/index.php/advancedreports/chart/tunnel
/index.php/ajaxproducts/index/index
/index.php/campaigner/abandoned/restore
/index.php/comm/message/crqu
/index.php/comm/returns/configureproduct
/index.php/customerconnect/rfqs/configureproduct
/index.php/emaildirect/abandoned/restore
/index.php/freegift/cart/gurlgift
/index.php/madecache/varnish/esi
/index.php/qquoteadv/download/downloadCustomOption
/index.php/simplebundle/Cart/add
/index.php/supplierconnect/orders/update
/index.php/supplierconnect/rfq/update
/index.php/vendors/credit/withdraw/review
/madecache/varnish/esi
/qquoteadv/download/downloadCustomOption
/simplebundle/Cart/add
/supplierconnect/orders/update
/supplierconnect/rfq/update
/vendors/credit/withdraw/review
/webgility1234/webgility-magento.php
/webgility123/webgility-magento.php
/webgility_12/webgility-magento.php
/webgility_13/webgility-magento.php
/webgility_1/webgility-magento.php
/webgility1/webgility-magento.php
/webgility_2/webgility-magento.php
/webgility2/webgility-magento.php
/webgility_3/webgility-magento.php
/webgility3/webgility-magento.php
/webgility_bk/webgility-magento.php
/webgility_dev/webgility-magento.php
/webgilitydev/webgility-magento.php
/webgility/webgility-magento.php
rhoerr
commented
5 years ago With https://github.com/gwillem/magevulndb/pull/23 being merged, should we consider expanding the list with any of those probes that are likely to be module routes and are not already covered?
It'll make for noise on the list that isn't necessarily actually a vulnerable module--but that's probably preferable to things slipping through the cracks. We can fill the info in if/when we do hear from people using them.
I'll prep a PR with them at some point, if so.
AlterWeb
commented
5 years ago I scanned all our customers Magento shops for the routes listed by @gwillem. All the matches that I found are pointing to a vulnerability in the sense that they lead to the Magento admin panel without knowing the url of the admin panel. This vulnerability should be fixed by the SUPEE-6788 Patch, but because this feature is disabled by default (and a lot of owners leave it this way because modules stop working after they enable it) this can be used to track down the admin url for many installations.
I don't know if we have to add those modules to the list because it is just a first step to get into the admin panel. After finding the admin url they still have to guess or bruteforce the user credentials. If you think we should add those modules I can make a PR with modules that we know of having this problem (there are a lot more then just the url's mentioned here). If not, I think you can can excluded the following url's from this list because they don't have another vulnerability as far as I can tell (or at least in the versions we have):
/index.php/admin_awautorelated/adminhtml_blocksgrid/ /index.php/Organizer/Task/List/ /index.php/ExtensionConflict/Admin/List/index/ /index.php/awall_admin/additional/index/ /index.php/AdvancedStock_Misc/MassStockEditor/key/ /index.php/AdvancedStock/Products/Grid/ /index.php/Scanner/index/index/
gwillem
commented
5 years ago I agree with @AlterWeb to not add modules to the vulnerability list that are merely exposing the admin frontname.
Probably a load more vulnerable extensions, should figure out what they are. All requested by 185.254.120.74 (LT), 185.153.197.28 (RU), 185.176.27.162 (BG) and 84.54.36.12 (NL, Worldstream).
They hit 404 on this particular site, so cannot tell what they were looking for..
User agent:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0