Severe vulnerability in Magento software puts global e-commerce at risk

The recently identified bug in the Magento platform, now owned by Adobe (acquired for $1.68 billion in 2018), represents a serious concern for the security of e-commerce operations. With widespread use in major companies in the United States and beyond, this platform has become a target for cyberattacks. CVE-2024-20720, a vulnerability allowing arbitrary code execution, was notably exploited by attackers via the beberli-assert library. Adobe responded quickly on February 13, eliminating this and other vulnerabilities, such as CWE-79, linked to Cross-Site Scripting (XSS) attacks.

Effects of the attack and industry reactions

According to reports from the General Prosecutor's Office of the Russian Federation, this flaw led to the interception of data from approximately 160,000 credit cards, showing the scale of the damage and the effectiveness of hackers in using this breach. This stolen data ended up on the black market, further exacerbating the situation. Pierluigi Paganini, CEO of CYBHORUS and member of ENISA, criticizes the slowness in applying the released patches and underlines how many organizations underestimate the importance of patch management, worsening the risks.

Tips for businesses using Magento

For companies that depend on Magento, a systematic and timely update of the platforms is recommended, not only to prevent future security incidents but also to maintain the effectiveness and reliability of the system. It is essential to implement a testing system that replicates the production environment, to verify updates before their actual deployment. These steps, while seeming burdensome, can save significant resources in the long term, protecting sensitive data and corporate reputation.

Proactive defense against cyber risks

The defense strategy must be multi-level, combining advanced technologies and conservative approaches. Steps such as monitoring for access anomalies, proactively identifying vulnerabilities, and using AI and machine learning to predict and prevent attacks are all vital elements of effective protection. Small and medium-sized businesses, in particular, should adhere to these practices, improving security without placing an undue burden on limited resources.