My years as a Magento security researcher

It’s been a long time since I posted here, but here’s something worth sharing. Most in the Magento community know me for my work on the platform as a developer and architect, but few knew I also spent a good part of my time between 2015 and 2018 wearing a security researcher’s hat.

During that period, I privately reported a number of security vulnerabilities in Magento 1 and 2. These included a Stored XSS in the admin panel triggered via crafted search queries from the frontend of the website, an RCE vulnerability via Media Upload functionality that allowed arbitrary path traversal and file deletion, an LFI in the RMA module, a CSRF exploit capable of silently deleting shopping cart price rules, a frontend XSS that enabled privilege escalation by compromising authenticated admin sessions, an RCE via unsafe Varnish VCL injection through the admin interface, and an insecure Swagger API integration in DevDocs that exposed authentication credentials through reflected request data to a server under my control.

It wasn’t limited to the core platform. I also found and reported serious vulnerabilities in quite a few third-party Magento extensions, as well as in-house modules developed by merchants, all disclosed through the proper channels. Some of those were truly wild — with impact potential that could have been massive if left unpatched.

One area in the Magento admin panel stood out for a different reason. It contained a serious vulnerability that could be exploited through three to four distinct functional paths. To make it more interesting, several other researchers independently reported the same underlying flaw, each using different methods of exploitation. That issue still makes me chuckle when I think about it — you’d see it listed as fixed in the release notes, only to find it was still exploitable through alternate paths, thanks to how deeply and redundantly embedded the root cause was.

This was also a time when Magento 2 was in its incubation phase — the architecture was still evolving, there were many open bugs, and the engineering team was busy moving fast with continuous development. Throughout this journey, I had the opportunity to work closely with Magento’s product, security, and engineering teams. They were excellent to collaborate with, which made the entire experience better.

Somewhere along the way, I ended up at number 2 on the Bugcrowd leaderboard — without even realizing it at the time. Today, I’m changing my Bugcrowd profile from private to public. It was fun while it lasted!

Magento vulnerabilities are no longer reported through Bugcrowd, as Adobe has since migrated its bounty program to HackerOne. If you discover any security issues, please report them responsibly via the official Adobe security page.