Critical Magento zero-day flaw CVE-2022
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-24086 | Unauthenticated RCE via checkout input-validation flaw in Adobe Commerce/Magento Adobe Commerce and Magento Open Source versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier contain an improper input validation flaw (CWE-20) in the checkout process. A remote attacker can trigger it with no privileges and no user interaction by submitting crafted input to a store's checkout flow, and successful exploitation results in arbitrary code execution on the server hosting the storefront. Any Adobe Commerce or Magento Open Source storefront running the affected versions is exposed, and because these are internet-facing e-commerce sites the practical exposure is broad. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15), its EPSS exploitation probability is 99.2% (100th percentile), and news reports describe ongoing attacks against Magento 2 stores, including recurring 'Xurum' attack campaigns and template-based attacks. Do: Upgrade every store to an Adobe-patched release per the vendor's instructions - i.e., any release newer than 2.4.3-p1 on the 2.4.x line or newer than 2.3.7-p2 on the 2.3.x line - noting that headlines indicate companion Magento CVEs were fixed in the same patch release, so consult Adobe's advisory for the full list. Because exploitation is unauthenticated and confirmed in the wild, prioritize internet-facing shops; WAF rules may reduce risk, but reports indicate WAF bypasses in related Magento attacks, so patching is the only reliable fix. After patching, review web server and application logs for exploitation attempts against the checkout flow and check affected hosts for indicators of compromise. | 9.8 | 99% | KEV |
| massroughly 100,000-300,000 online storefronts (Magento/Adobe Commerce is among the most widely deployed e-commerce platforms) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | naturalfreshmall.com | n deployed a digital skimmer that was being loaded from the naturalfreshmall(.)com domain. More than 350 ecommerce stores infected with malw |
| domain | pixel.js | s load the malware via https://naturalfreshmall[.]com/image/pixel[.]js. — Sansec (@sansecio) January 25, 2022 An interesting cha |
Full article368 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 14, 2022
Adobe addressed a critical vulnerability (CVE-2022-24086) impacting Magento Open Source products that is being actively exploited in the wild.
Adobe rolled out security updates to address a critical security vulnerability, tracked as CVE-2022-24086, affecting its Commerce and Magento Open Source products that is being actively exploited in the wild.
“Adobe is aware that CVE-2022-24086 has been exploited in the wild in very limited attacks targeting Adobe Commerce merchants.” reads the advisory published by Adobe.
The flaw is an “improper input validation” vulnerability that could be exploited by threat actors with administrative privileges to achieve arbitrary code execution on vulnerable systems.
The CVE-2022-24086 has received a CVSS score of 9.8 out of 10, it is classified as a pre-authentication issue which means that it could be exploited without credentials.
The vulnerability affects the following versions of the products:
| Product | Version | Platform |
|---|---|---|
| Adobe Commerce | 2.4.3-p1 and earlier versions | All |
| 2.3.7-p2 and earlier versions | All | |
| Magento Open Source | 2.4.3-p1 and earlier versions | All |
| 2.3.7-p2 and earlier versions | All |
Adobe Commerce 2.3.3 and lower are not affected by this vulnerability.
Last week, researchers from cybersecurity firm Sansec uncovered a massive Magecart campaign that already compromised more than 500 online stores running the Magento 1 eCommerce platform.
Threat actors behind this campaign deployed a digital skimmer that was being loaded from the naturalfreshmall(.)com domain.
— Sansec (@sansecio) January 25, 2022More than 350 ecommerce stores infected with malware in a single day.
Today our global crawler discovered 374 ecommerce stores infected with the same strain of malware. 370 of these stores load the malware via https://naturalfreshmall[.]com/image/pixel[.]js.
An interesting characteristic of this attack is the combination of SQL injection and PHP object injection to take over the Magento store.
Experts pointed out that Magento 1 platform has reached End-of-Life and that for this reason will no longer receive security updates.
URGENT: install the latest Magento 2 patch today. It is being abused already, and allows unauthenticated remote code execution on your store (eg the worst possible vulnerability).https://t.co/dSB0wdWD0k
— Sansec (@sansecio) February 14, 2022
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Magento)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/127999/hacking/cve-2022-24086-zero-day.html