Researchers created a PoC exploit for recently disclosed critical Magento CVE-2022
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-24086 | Unauthenticated RCE via checkout input-validation flaw in Adobe Commerce/Magento Adobe Commerce and Magento Open Source versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier contain an improper input validation flaw (CWE-20) in the checkout process. A remote attacker can trigger it with no privileges and no user interaction by submitting crafted input to a store's checkout flow, and successful exploitation results in arbitrary code execution on the server hosting the storefront. Any Adobe Commerce or Magento Open Source storefront running the affected versions is exposed, and because these are internet-facing e-commerce sites the practical exposure is broad. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15), its EPSS exploitation probability is 99.2% (100th percentile), and news reports describe ongoing attacks against Magento 2 stores, including recurring 'Xurum' attack campaigns and template-based attacks. Do: Upgrade every store to an Adobe-patched release per the vendor's instructions - i.e., any release newer than 2.4.3-p1 on the 2.4.x line or newer than 2.3.7-p2 on the 2.3.x line - noting that headlines indicate companion Magento CVEs were fixed in the same patch release, so consult Adobe's advisory for the full list. Because exploitation is unauthenticated and confirmed in the wild, prioritize internet-facing shops; WAF rules may reduce risk, but reports indicate WAF bypasses in related Magento attacks, so patching is the only reliable fix. After patching, review web server and application logs for exploitation attempts against the checkout flow and check affected hosts for indicators of compromise. | 9.8 | 99% | KEV |
| massroughly 100,000-300,000 online storefronts (Magento/Adobe Commerce is among the most widely deployed e-commerce platforms) |
Full article427 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 18, 2022
Researchers developed an exploit code for CVE-2022-24086 vulnerability affecting Adobe Commerce and Magento Open Source.
Positive Technologies researchers have created a working PoC exploit for the recently patched CVE-2022-24086 vulnerability affecting its Commerce and Magento Open Source products.
An attacker could use the exploit to achieve remote code execution from an unauthenticated user.
— PT SWARM (@ptswarm) February 17, 2022🔥 We have reproduced the fresh CVE-2022-24086 Improper Input Validation vulnerability in Magento Open Source and Adobe Commerce.
Successful exploitation could lead to RCE from an unauthenticated user. pic.twitter.com/QFXd7M9VVO
This week, Adobe rolled out security updates to address the critical CVE-2022-24086 flaw that impacts Commerce and Magento Open Source products, the company added that the flaw is being actively exploited in the wild.
“Adobe is aware that CVE-2022-24086 has been exploited in the wild in very limited attacks targeting Adobe Commerce merchants.” reads the advisory published by Adobe.
The issue is an “improper input validation” vulnerability that could be exploited by threat actors with administrative privileges to achieve arbitrary code execution on vulnerable systems.
The CVE-2022-24086 has received a CVSS score of 9.8 out of 10, it is classified as a pre-authentication issue which means that it could be exploited without credentials.
Experts believe that threat actors could create their own version of the CVE-2022-24086 exploit to conduct attacks in the wild, especially persistent and well-resourced attackers.
The flaw could be exploited to compromise e-stores using a vulnerable version of Magento.
The good news is that the researchers will not publicly release their PoC exploit code.
This week, US Cybersecurity and Infrastructure Security Agency (CISA) added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including the CVE-2022-24086 flaw. CISA orders all Federal Civilian Executive Branch Agencies (FCEB) agencies to address it by March 1st, 2022.
Adobe has also updated the security advisory for this flaw by adding a new Improper Input Validation flaw tracked as CVE-2022-24087 (CVSS score 9.8).
The CVE-2022-24087 flaw was reported by researchers Eboda and Blaklis.
Blaklis warns that admins that have patched with the first patch are not secure even after applying the new updates.
A new patch have been published for Magento 2, to mitigate the pre-authenticated remote code execution. If you patched with the first patch, THIS IS NOT SUFFICIENT to be safe.
— Blaklis (@Blaklis_) February 17, 2022
Please update again!https://t.co/vtYj9Ic6ds@ptswarm (as you had a PoC too!)#magento
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Magento)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/128144/security/magento-cve-2022-24086-bug-poc.html