Magento 2 Carding attack guest cart order placed even if we disable guest cart using REST API

Question

I am using Magento 2.4.7-p1 hackers are trying to place order using guest cart REST API carding attacks tried cloudflare , rate limit magento and captcha also, but no use in braintree created so many rules, but no use.

As per our analysis, this request will be used while making orders from APIs not from the front end if we disable this API from the code level under this file.

vendor/magento/module-quote/etc/webapi.xml

Code to comment is below.

###############################################

################################################

disabled above code still carding attack is running.

https://community.magento.com/t5/Magento-2-x-Technical-Issues/rest-default-V1-guest-carts-open-to-DDOS/td-p/421447

can any one please tell how to stop guest order rest api

Answer 1

They can try as many times as they want, if you upgrade your magento 2 to latest security patch releases...they will be blocked by Content Security Policies. More details in CSP ASPB Security Patch

• Pavan kumarMG: already, i am using latest version and enabled csp

Answer 2

Several solutions:

• Turn off guest checkouts completely at Stores > Configuration > Sales > Checkout > Checkout Options > Allow guest checkout:

enter image description here

• Programmatically block guest API orders.

vendor/magento/module-quote/Model/GuestCart/GuestCartManagement.php:

 public function placeOrder($cartId, PaymentInterface $paymentMethod = null)
 { 
+ return; //add this return and remove the plus sign
 $quoteIdMask = $this->quoteIdMaskFactory->create()->load($cartId, 'masked_id');
 $this->cartRepository->get($quoteIdMask->getQuoteId())
 ->setCheckoutMethod(CartManagementInterface::METHOD_GUEST);
 return $this->quoteManagement->placeOrder($quoteIdMask->getQuoteId(), $paymentMethod);
 }