Vulnerabilitycritical
Magento wish list exploit bypasses WAF protection
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-24086 | Unauthenticated RCE via checkout input-validation flaw in Adobe Commerce/Magento | 9.8 | 99% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 69.49.246.122 | s it with PHP. In turn, this downloads a trojan from http://69.49.246.122/[HASH].php . The following may show up in your server's pro |
| ipv4 | 79.141.160.185 | n run a basic scan free of charge. Indicators of compromise 79.141.160.185 attacker IP, HZ Hosting Ltd (AS202015) 69.49.246.122 C2 ser |
From the original article
5 min read at sansec.io
In recent weeks, Sansec observed a spike in hacked Magento 2 stores. Our investigations led to a (likely) single attacker, who used a combination of clever techniques to bypass WAFs and competing threat actors. This article lists the methods and discovered attack code.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.