In a striking revelation, a backdoor hidden within widely-used Magento extensions for online stores has come to light after remaining undetected for six years, making its presence felt on April 20. This security breach has affected hundreds of digital storefronts, highlighting critical vulnerabilities in third-party risk management. According to security firm Sansec, the backdoor was part of a coordinated hack, with malicious code quietly inserted into download servers operated by extension vendors like Tigren, Magesolution, and Meetanshi.
Sansec’s investigation estimates that between 500 to 1,000 online stores are running the compromised software, including a massive $40 billion multinational corporation. The researchers noted the rarity of a backdoor going unnoticed for such a long period, and it is even more unusual that the actual exploitation of this backdoor has only recently begun. The malicious code was hidden in 21 modules published between 2019 and 2022, with files named License.php or LicenseApi.php containing the harmful logic.
Once activated, the backdoor exploits the adminLoadLicense function to execute remote PHP payloads, granting attackers the capability to inject arbitrary code. This vulnerability has paved the way for Magecart-style skimming, where attackers use scripts to capture payment card details and personal data during the checkout process. Sansec’s findings also suggest that another provider, Weltpixel, might have a compromised GoogleTagManager extension, although the initial attack vector remains unclear.
The compromised extensions from Tigren include Ajaxsuite, Ajaxcart, and MultiCOD, among others. Meetanshi’s affected modules feature ImageClean and Flatshipping, while MGS packages like Lookbook and StoreLocator are also impacted. The discovery of these vulnerabilities has prompted mixed reactions from vendors. While Magesolution has not responded to inquiries and continues to offer infected packages, Tigren denies any breach but still distributes the compromised extensions. Conversely, Meetanshi acknowledged a server breach yet insists its released code was untampered.
This incident underscores the importance of robust third-party risk management strategies to protect against emerging threats. Organizations must remain vigilant and proactive in identifying and mitigating vulnerabilities within their software supply chains to safeguard sensitive customer data and maintain trust in digital transactions.