Magento Connect Manager Installer - Detect

What is the "Magento Connect Manager Installer - Detect?"

The "Magento Connect Manager Installer - Detect" module is designed to detect the presence of the Magento Connect Manager installer. This software is accessible through the "/downloader/" location and requires Magento admin rights for installation. It utilizes the same authorization methods as the backend, meaning that if an attacker obtains a matching pair of login and password, the installation can be compromised. The severity of this module is informative, indicating that it provides valuable information about potential vulnerabilities.

Author: 5up3r541y4n

Impact

The presence of the Magento Connect Manager installer can pose a security risk if not properly secured. If an attacker gains access to the installation process by obtaining valid login credentials, they can compromise the installation and potentially gain unauthorized access to the Magento system.

How does the module work?

The "Magento Connect Manager Installer - Detect" module works by sending an HTTP GET request to the "/downloader/" path. It then applies a series of matching conditions to determine if the Magento Connect Manager installer is present:

- The response body must contain the words "Magento Downloader" and "Log In". - The response header must include the word "text/html". - The HTTP status code must be 200 (OK).

If all of these conditions are met, the module identifies the presence of the Magento Connect Manager installer.

Example HTTP request:

GET /downloader/ HTTP/1.1
Host: example.com