X-Cart forums

[carpeperdiem]

Dear X-Cart,

About a month ago, you dropped a security patch...

security-patch-2013-10-08

May I ask WHY there were no announcements, no emails, no posts or notices of any kind about this? May I ask how you expected users to learn about this security patch?

IMPACT
- XSS vulnerability for the Product_Configurator(Product Wizard) module (<= 4.6.1);
- XSS vulnerability for the Feature_Comparison module (<= 4.6.0);
- In some cases, customers can view orders of other customers (<= 4.6.0);
- Hacker can gain full access to the store's Admin back end through the 'Hidden Categories' module (<=4.6.0);
- Potential XSS vulnerability for some modules and product catalogs in the Customer area (<=4.5.5);

SO -- does this mean that if we do not use these modules, we can skip it?

Product_Configurator
Feature_Comparison
Hidden Categories

- Potential XSS vulnerability for some modules and product catalogs in the Customer area

What modules? Under what circumstances?

A thorough discussion of this patch would be appreciated.

[Ksenia]

Hi Jeremy,

I would like to comment on the announcements part.

Actually, there were announcements. In particular, there was a newsletter sent Sent on Oct 08 (to entire list of our users subscribed to security updates and alerts).

Some users have even discussed the patch on our forum (http://forum.x-cart.com/showthread.php?t=68019, http://forum.x-cart.com/showthread.php?t=67911).

I have checked your HelpDesk profile and noticed that "Security updates and alerts:" checkbox in "Newsletter" section is not selected. As I know, by default the users are subscribed to this newsletter, which makes me think that you have either unchecked it manually or there was a technical problem at some moment. So I have added you to the list of subscribers with both subscription options, 'security updates' and 'company news', if you want to be excluded from the second one, please PM me.

Another way I used to inform the customers is a 'news' in HelpDesk. It was shown on October, 8 - October 21st. Probably you haven't visited HelpDesk during that period, or haven't paid attention to the announcement.

But I hope next time the news about security patch will not slip out of your attention.

The technical part will be addressed separately, I have already shown this message to the engineers, so please expect an update shortly.

[carpeperdiem]

I have checked your HelpDesk profile and noticed that "Security updates and alerts:" checkbox in "Newsletter" section is not selected.

Obviously, not something I would do. And if I were X-Cart, I wouldn't offer unsubscribing from security and alert emails as an option. Security alerts must be sent, even if the user doesn't want to receive them. PS -- I never unsubscribed from any xcart emails. If you are an x-cart cusotmer and reading this, I suggest you check your communications prefs in your account profile in case you were switched off too.

Some users have even discussed the patch on our forum (http://forum.x-cart.com/showthread.php?t=68019, http://forum.x-cart.com/showthread.php?t=67911).

But the title of the thread is "SQL error notification injection attack?" - unless you expect everyone to read every post (impossible for non-X-Cart staff, right?) -- and there was no post in the News and Announcements sub-forum (where it should have been posted at same time as email).

Another way I used to inform the customers is a 'news' in HelpDesk. It was shown on October,ctober 21st. Probably you haven't visited HelpDesk during that period, or haven't paid attention to the announcement.

I only visit the helpdesk home page, well, never -- I have deep links to the file area and communications center.

THE ONLY WAY to reach everyone is mandatory email for these types of alerts (and a post in the news section of the forum here).

I appreciate your response here -- and I look forward to discussing the technical aspects of this patch with engineering. Thanks!
Jeremy

[carpeperdiem]

I received a PM from engineering -- and in case anyone is reading this, the answer is, "do the patch" since there are many files that are involved. The engineer was very specific and asked me not to share every detail in public forum for security purposes. But after reviewing the files, we should all do this patch.

Thanks to X-Cart for fast answers.