CVE-2018-5301

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in Magento Community Edition and Enterprise Edition prior to version 2.0.10 and in 2.1.x prior to 2.1.2 [1]. The flaw allows an attacker to trigger the deletion of a customer address from the address book without the victim's knowledge or consent, identified as APPSEC-1433.

Exploitation

To exploit this vulnerability, an attacker must craft a malicious HTTP request that would cause the deletion of a customer address. The attacker then needs to trick an authenticated Magento user into submitting this request, typically by visiting a malicious website or clicking a link while logged into Magento. No special network access or authentication is required beyond the victim being logged in [1].

Impact

Successful exploitation results in the unauthorized deletion of a customer address from the victim's address book. This can lead to inconvenience for the customer, potential disruption of order fulfillment if the deleted address was primary, and loss of stored data. The impact is limited to address deletion, with no further compromise of the system [1].

Mitigation

A security update was released by Magento to address this vulnerability. Users should upgrade to Magento 2.0.10 or later for the 2.0.x branch, or Magento 2.1.2 or later for the 2.1.x branch [1][3]. If upgrading is not immediately possible, administrators should apply the security patch provided in the Magento Security Center [3]. No workarounds are documented.