Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an XML injection vulnerability in the 'City' field. The injection occurs when user-supplied input is improperly handled during XML processing, allowing an attacker to inject arbitrary XML elements. This vulnerability is reachable without authentication, as the 'City' field is typically part of the checkout or address input forms exposed to unauthenticated users [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted request containing malicious XML in the 'City' field. No special network position or prior authentication is required. The crafted script is processed by the application's XML parser, enabling the injection of arbitrary XML content that is then interpreted by the backend [1].

Impact

Successful exploitation allows the attacker to achieve remote code execution (RCE) on the underlying server. This grants the attacker full control over the affected system, leading to complete compromise of confidentiality, integrity, and availability (CIA) of the Magento instance and potentially associated data [1].

Mitigation

Adobe has released security updates to address this vulnerability. Users should upgrade to Magento Commerce 2.4.3, 2.4.2-p2, or 2.3.7-p1 (or later) as soon as possible. There are no known workarounds; applying the official patch is the recommended mitigation [1]. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.