X-Cart forums

[LTucker]

I'm attempting to find out if X-Cart has been affected by the Log4j vulnerability in any way. I have reached out to the X-Cart support team about this issue and did not receive a response.

I have run the scanner manually on the core X-Cart application. As expected the core X-Cart application was not affected by this vulnerability. I can not run the scanner on the APIs that X-Cart or X-Payments use, and do not maintain control over these items.

Did anyone reach out and receive a statement from the X-Cart team about the Log4j vulnerability and how X-Cart was impacted?

Reference
CISA Apache Log4j Vulnerability Guidance

[Triple A Racing]

Good luck waiting for a useful, tested response from the X-Cart support team...

Not 100% sure about fully verifying API's, but you could use the two tools linked from here, if you wish to dig deeper:

https://www.infoworld.com/article/3644492/how-to-detect-the-log4j-vulnerability-in-your-applications.html

[Ed B.]

Unless you run log4j on your server, your server shouldn't be affected by this issue, should it? And log4j being a java application, I don't see how X-cart which is based on php/javascript can be affected.

[LTucker]

Okay thank you, that's unfortunate to hear. I appreciate the added resources. I used the CISA scanner from the original post to scan the web server and X-Cart app.

Yes, X-Cart is a PHP based platform which wouldn't directly be affected by this vulnerability. Though many backend services use Java which makes this vulnerability so dangerous. For example cPanel was affected.

I'm mostly wondering how X-Payments was impacted, and if they have reached out to the API services that are used in the XC/ Qualiteam modules. As there are a lot of RESTful services that were built with Java.