Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

CVE-2021-36021 describes an improper input validation vulnerability in the CMS page scheduled update feature of Adobe Magento. The affected versions are 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier). The root cause is that the feature fails to properly validate input, which allows an attacker to inject and execute arbitrary code on the server [1].

Exploitation

To exploit this vulnerability, an attacker must first authenticate as an administrative user on the Magento instance. No additional network-level or other authentication bypass is mentioned. The attack surface is the CMS page scheduled update functionality, where the improper input validation occurs. The attacker can craft a malicious input that, when processed by the scheduled update mechanism, leads to code injection [1].

Impact

Successful exploitation grants the attacker remote code execution on the underlying system. This means the attacker can execute arbitrary commands, potentially compromising the entire application, accessing sensitive data, modifying files, or pivoting to other systems. Because the attacker already has administrative privileges, the impact is severe, potentially leading to full server compromise [1].

Mitigation

Adobe has addressed this vulnerability in Magento versions 2.4.3, 2.4.2-p2, and 2.3.7-p1 or later. Users should upgrade to these patched versions immediately. The vendor's official repository provides the source code and release information [2].