I just received an e-mail from my government cyber department, that my shop (based on OC 1.5.6.4) in unsafe because user accounts can be easily modified thanks to Cross-Site Request Forgery (CSRF) attack.
When a customer is logged in and customer opens a custom html file, that contains:
Code: Select all
<form action="https://www.mullitaja.ee/index.php?route=account/edit" method="POST" enctype="multipart/form-data">
<input type="hidden" name="firstname" value="spider" />
<input type="hidden" name="lastname" value="spider" />
<input type="hidden" name="email" value="hacker@hacked.com" />
<input type="hidden" name="telephone" value="+1 (209) 209-7896" />
<input type="hidden" name="fax" value="+1 (232) 922-8831" />
<input type="submit" value="Submit request" />
</form>
Need help on fixing that issue or some kind of extension.
I've tried modifying .htaccess file with these lines:
Code: Select all
# Prevent caching
Header always set Cache-Control "no-store, no-cache, must-revalidate"
# Always set these headers for CORS with an expiration time of 20 seconds.
Header always set Access-Control-Max-Age "200"
Header always set Access-Control-Allow-Origin "https://www.mullitaja.ee"
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS, DELETE, PUT"
Header always set Access-Control-Allow-Headers "DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, C$"
Header always set Access-Control-Allow-Credentials "false"
# Additional security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
# Disable Expires header
Header always unset Expires
