Amasty patches dozens of Magento extensions, 2 critical
Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.
Extension vendor Amasty released fixes for a large batch of Magento and Adobe Commerce modules, with critical unauthenticated file upload flaws in Advanced Product Reviews and Gift Card that allow attackers to plant web shells and take full control of stores. Dozens of additional high-, medium- and low-severity extensions were also patched. The vendor says the release affects almost every Magento and Adobe Commerce store. A related Order Attributes flaw was previously exploited heavily, with Sansec Shield blocking over 12,000 attempts against 25% of Magento stores in three days.
- Two critical flaws in Advanced Product Reviews and Gift Card allow unauthenticated web shell upload and full store takeover
- Arbitrary upload locations defeat standard PHP execution blocking under pub/media
- Dozens of additional high, medium and low severity extensions patched with fixed package versions listed
- The related Order Attributes flaw saw 12,000+ blocked exploitation attempts across 25% of Magento stores in three days
From the original article
7 min read at sansec.io
Amasty issues a massive security release for dozens of extensions. Two are critical and can lead to remote code execution. Sansec Shield already blocks the critical issues, and emergency mitigation for the medium severity issues is in progress.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.