Cisco merch shoppers stung in CosmicSting attack

Dangerous information for anybody who bought a Cisco hoodie earlier this month: Suspected Russia-based attackers injected data-stealing JavaScript into the networking large’s on-line retailer promoting Cisco-branded merch.

Cisco has since mounted the difficulty attributable to a flaw in Adobe’s Magento platform, which may have allowed crooks to steal consumers’ bank card particulars and different delicate data at checkout.

“A Cisco-branded merchandise web site that is hosted and administered by a third-party provider was briefly taken offline whereas a safety subject was addressed,” a Cisco spokesperson instructed The Register. 

“Primarily based on our investigation, the difficulty impacted solely a restricted variety of web site customers, and people customers have been notified,” the spokesperson mentioned. “No credentials have been compromised.”

On this explicit case, the unknown attacker(s) reportedly exploited CVE-2024-34102, a important, 9.8-rated vulnerability in Adobe Magento software program, broadly utilized by eCommerce web sites and a favourite goal for thieves seeking to intercept and steal transaction knowledge from unsuspecting customers. These kind of Magento-targeting exploits are collectively referred to as Magecart assaults.

CVE-2024-34102, which places unpatched techniques vulnerable to XML exterior entity injection (XXE) and distant code execution (RCE), was noticed by researcher Sergey Temnikov, who claims he reported the difficulty to Adobe and acquired a $9,000 bug bounty for this discover.

Adobe patched the flaw on June 11, however per week later, eCommerce monitoring agency Sansec reported that solely 25 p.c of shops had upgraded their software program. In the meantime, criminals automated the assault to scale to hundreds of web sites, and a number of proof-of-concept exploits popped up on GitHub and elsewhere.

It seems Cisco’s merchandise retailer was one among these unpatched websites, and on the time of the assault was working Magento 2.4 (Enterprise).

In keeping with c/aspect researchers who analyzed the malicious JS code, it was hosted on a site with a Russia-based IP deal with. The area, rextension[.]web/za/, was registered on August 30.

“The area’s current registration raises pink flags because it may point out a fly-by-night operation designed for fast exploitation earlier than being deserted,” c/aspect’s Himanshu Anand famous. 

“Obfuscated scripts like these are troublesome to detect with out specialised monitoring, making them particularly harmful for each web site house owners and their clients,” he added. ®