Add CosmicSting vulnerability (CVE-2024-34102) page

docs/best-practices/security/how-to-deal-with-the-cosmicsting-vulnerability-cve-2024-34102-on-hypernode.md

@@ -0,0 +1,164 @@
+---
+myst:
+  html_meta:
+    description: CosmicSting (CVE-2024-34102) is a critical vulnerability in Magento
+      and Adobe Commerce that lets attackers read any file. Learn how to fix it, how
+      to detect attacks on Hypernode, and what to do if your shop was infected.
+    title: How to Deal with the CosmicSting Vulnerability (CVE-2024-34102) on Hypernode
+      | Security | Hypernode
+---
+
+# How to Deal with the CosmicSting Vulnerability (CVE-2024-34102) on Hypernode
+
+CosmicSting is a critical vulnerability in Magento and Adobe Commerce that lets attackers read any file on the server. It is tracked as CVE-2024-34102 and scored CVSS 9.8. This article explains how the vulnerability works, how to fix it, how to detect attacks on Hypernode, and what to do if your shop was infected.
+
+For a full analysis of the attacks, including the attacker groups and a complete list of indicators of compromise, see the [CosmicSting attack & defense overview](https://sansec.io/research/cosmicsting) by Sansec.
+
+## What Is CosmicSting?
+
+Adobe released a fix for CosmicSting on 11 June 2024. Within weeks, attackers started scanning and infecting stores worldwide. Sansec observed stores getting hacked at a rate of 5 to 30 per hour.
+
+The following Magento and Adobe Commerce versions are affected:
+
+- 2.4.7 and earlier
+- 2.4.6-p5 and earlier
+- 2.4.5-p7 and earlier
+- 2.4.4-p8 and earlier
+
+```{warning}
+According to Sansec, the secret keys have likely been stolen from any store that did not upgrade before 25 June 2024. As long as the old keys are not invalidated, the store remains vulnerable to malware injections, even after patching.
+```
+
+### How the Attack Works
+
+A typical attack works as follows:
+
+1. The attacker steals the crypt key from `app/etc/env.php`.
+1. With this key, the attacker generates a JSON Web Token (JWT) with unrestricted API access.
+1. The attacker lists the CMS blocks with `GET /V1/cmsBlock/search`.
+1. The attacker injects malicious JavaScript into the CMS blocks with `PUT /V1/cmsBlock/{id}`. This JavaScript steals the payment data of your customers.
+
+Because the attacker uses the crypt key instead of an admin account, changing admin passwords alone does not help.
+
+Combined with CVE-2024-2961 (also known as CNEXT), attackers can also run code on the server and install backdoors.
+
+## How to Fix the Vulnerability
+
+Fixing CosmicSting takes two steps. You need to do both.
+
+### Step 1: Install the Patch
+
+The recommended solution is to upgrade to the latest Magento version. Keep in mind that this upgrade includes functional changes, such as a strict Content Security Policy (CSP), which may break your checkout flow. Test the upgrade before you deploy it to production.
+
+If you cannot upgrade, install Adobe's isolated patch instead. For more information about installing patches, see [How to Apply Magento Patches](how-to-apply-magento-patches.md).
+
+### Step 2: Rotate the Encryption Key
+
+Patching alone is not enough. Assume that your old key has already been stolen. Attackers who have the old key can still use it to generate tokens. Rotate the encryption key with the following command:
+
+```bash
+bin/magento encryption:key:change
+```
+
+On older Magento versions, the isolated patch adds this command. See Adobe's key rotation article for more information.
+
+```{important}
+Rotating the encryption key re-encrypts stored data. Plan a maintenance window before you run the command.
+```
+
+After rotating, make sure the old key is invalidated:
+
+- Magento keeps old keys in `crypt/key` in `app/etc/env.php`, and accepts tokens signed with any key in this list. Remove the old key from this list after re-encrypting.
+- Adobe released hotfix AC-12485 on 21 August 2024 to invalidate old encryption keys.
+- According to Sansec, secrets that were encrypted with the old key are not automatically re-encrypted with the new key. Sansec recommends a module by GENE Commerce to automate this.
+
+Rotating the key does not revoke API tokens that already exist, because these tokens are stored in the database. After rotating the key:
+
+- Reset all admin passwords.
+- Delete any API integrations you do not recognize.
+
+```{note}
+Installing patches is the responsibility of the customer or their developer.
+```
+
+### Stop-Gap Fix
+
+If you cannot install the patch and rotate the key in the short term, you can block all requests to the CMS block API as an emergency measure. Add the following code to the top of `app/bootstrap.php`:
+
+```php
+if (preg_match('/\/rest\/.*\/cmsBlock/m', $_SERVER['REQUEST_URI']??'')) {
+    http_response_code(503);
+    echo "Service Unavailable";
+    exit();
+}
+```
+
+```{warning}
+This only stops attackers from updating your CMS blocks. Your shop is not safe. Attackers can still read any file on your server, including your new encryption key, use other REST endpoints, for example to steal customer data via the orders endpoint, and in the worst case run code on your server.
+```
+
+## How to Detect Attacks on Hypernode
+
+On Hypernode, requests that match the CosmicSting attack are written to `/var/log/nginx/CVE-2024-34102.log`.
+
+To see how these requests were handled, run:
+
+```bash
+grep estimate-shipping-methods /var/log/nginx/access.log
+```
+
+An attack usually shows up as a log entry like this:
+
+```text
+157.230.230.193 - "POST /rest/V1/guest-carts/123456/estimate-shipping-methods HTTP/1.1" 404 148
+```
+
+The cart ID (`123456` in this example) can be anything.
+
+- On a patched shop, an HTTP `400` response means that the request was rejected.
+- On an unpatched shop, assume that the attacker succeeded in reading `app/etc/env.php`, even if Magento responded with an HTTP `404`.
+
+Scans for this vulnerability run continuously, so it is normal to see attempts in your logs. On a patched shop with a rotated key, an attempt in the logs does not mean that your shop was compromised.
+
+## How to Check Whether Your Shop Was Infected
+
+Check the following:
+
+- **CMS blocks:** look for `<script>` tags or other JavaScript that you did not add, especially at the bottom of the blocks. Attackers often inject the same script into every CMS block.
+- **Admin users and integration tokens:** look for users and integrations you do not recognize.
+- **Backdoors:** if attackers combined CosmicSting with CNEXT, they may have installed backdoors. Sansec observed backdoors in the file `.config/htop/defunct.dat` and in background processes named `[slub_flushwq]`, `[raid5wq]`, `[card0-crtc8]`, `[netns]` and `[kswapd0]`.
+- **Known malicious domains and IP addresses:** compare the domains in your CMS blocks and the IP addresses in your logs with the [full list of attack indicators](https://sansec.io/research/cosmicsting#full-list-of-attack-indicators) by Sansec.
+
+To check for the backdoor file and processes, run:
+
+```bash
+ls -la ~/.config/htop/defunct.dat
+ps -u app -o pid,args | grep -E "slub_flushwq|raid5wq|card0-crtc8|netns|kswapd0"
+```
+
+Processes with these names that run as the `app` user are suspicious. On a normal system, they only exist as kernel processes.
+
+### Scan Your Shop with Sansec
+
+Manual checks do not always find all malware, because attackers often hide their code. A scan with [Sansec eComscan](https://sansec.io/ecomscan) helps you find malware, backdoors, and known vulnerabilities in your shop. eComscan comes preinstalled on every Hypernode. To start a scan, run the following command:
+
+```bash
+ecomscan /data/web/magento2
+```
+
+If your shop lives in a different folder, change the path accordingly. See [How to Set Up Sansec eComscan on Hypernode](../../hypernode-platform/tools/how-to-set-up-sansec-ecomscan-on-hypernode.md) for more information.
+
+### Prevent New Infections
+
+To prevent new infections, use a CSP monitoring tool that alerts you about unauthorized JavaScript on your shop. Sansec Watch is free of charge and integrates with Magento.
+
+## What to Do If Your Shop Was Infected
+
+If your shop was infected:
+
+1. Remove the malicious code from your CMS blocks, and remove unknown admin users and integration tokens.
+1. Make the folder where the malware keeps returning non-writable.
+1. Rotate the encryption key and invalidate the old key, as described above.
+1. Reset all admin passwords.
+
+See [How to Recover a Hacked Magento Shop](how-to-recover-a-hacked-magento-shop.md) for the general recovery steps.