CVE-2019-8135

Root

Cause

CVE-2019-8135 is a remote code execution vulnerability in Magento versions 2.2 prior to 2.2.10 and 2.3 prior to 2.3.3 or 2.3.2-p1. The flaw resides in the Symfony framework's dependency injection mechanism, where service identifiers can be derived from user-controlled data. This allows an attacker to manipulate the service resolution process [1][2].

Exploitation

Prerequisites

The vulnerability is exploitable by sending crafted HTTP requests to the Magento application. No authentication is required, making it accessible to unauthenticated, remote attackers. The attack surface is the Symfony DI container, which processes user input to determine which service to instantiate [1][2].

Impact

Successful exploitation leads to full remote code execution on the server. An attacker can execute arbitrary PHP code, potentially gaining complete control over the Magento instance, including access to customer data, order information, and administrative credentials [1][3].

Mitigation

Adobe released security patches in Magento 2.2.10 and 2.3.3/2.3.2-p1. Users are strongly advised to upgrade immediately. The vulnerability is not listed in CISA's KEV as of the publication date [3].