Critical backdoor found in MGT Varnish extension

Sansec researchers discovered a critical vulnerability in the popular Varnish module for Magento. This module, developed by MGT Commerce, contains a hidden backdoor that allows remote PHP code execution.

The backdoor was likely inserted to enable remote upgrades and debugging support. However, the protection mechanism can be trivially bypassed and it poses a serious risk to all stores running Mgt_Varnish version 1.0.10 or earlier.

Sansec ran a global Internet scan and found hundreds of vulnerable stores.

How does it work?

The backdoor is located in the feed update controller (Mgt/Varnish/Controller/Feed/Update.php). When activated, it writes attacker-supplied code to a temporary file and executes it as PHP. The code attempts to restrict access to a single IP address (54.84.48.253), apparently used by MGT Commerce:

console-test.mgt.io
feed.mgt-commerce.com

However, there are two flaws in the protection mechanism:

1. MD5 is unsafe: The "management IP" is hidden using an MD5 hashing function. MD5 has been deprecated since 2004 and can be broken in about 40 seconds using modern hardware.

2. IP spoofing: The IP check uses X-Forwarded-For headers, which in many configurations can be spoofed by an attacker. This header is typically set by proxies and load balancers, but if not properly validated, an attacker can inject their own value. This effectively allows anyone to execute arbitrary PHP code on the server.

How to check your store

Search for the file Mgt/Varnish/Controller/Feed/Update.php. If it exists and contains md5($remoteAddress) your store is at risk.

The backdoor code has multiple variants with different obfuscation levels, but all versions contain the same vulnerability.

Impact

This vulnerability allows remote code execution (RCE), which means an attacker can:

• Install payment card skimmers to steal customer payment data
• Access and exfiltrate customer databases
• Install persistent backdoors for long-term access
• Modify store functionality or deface the website
• Use the server as part of a botnet or for other malicious activities

Given the critical nature of this vulnerability and the ease of exploitation, all affected stores should be considered potentially compromised.

Recommendations

If you are not using Sansec Shield for active protection of your Magento store, you should:

1. Immediately update to Mgt_Varnish version 1.1.0 or later, or replace the module with a high-quality alternative such as Elgentos Varnish Extended.
2. Check for signs of a compromise. If you've been running the vulnerable version, assume the worst and audit your server for malicious code

Sansec eComscan detects this backdoor and can help identify if your store has been compromised.

Vendor response

MGT Commerce confirmed the vulnerability and released a fixed version (1.1.0) within two days of being notified. We appreciate their prompt response and cooperation in addressing this critical security issue.

Timeline

Read more

• Claude finds 353 zero-days on Packagist
• The billion-dollar security.txt problem
• Keylogger targets 200,000+ employees at major US bank
• ConnectPOS leaked Github secrets for years
• SessionReaper attacks have started, 3 in 5 stores still vulnerable