Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2, 2.4.2-p1, and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An authenticated admin attacker can inject malicious XML payloads through the widget update mechanism, leading to improper processing of XML input [1].

Exploitation

An attacker with admin privileges can craft a specially formed XML payload and submit it via the Widgets Update Layout feature. The application does not properly sanitize the XML input, allowing the attacker to inject external entities or other XML constructs that result in arbitrary code execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Magento server, potentially leading to full compromise of the application and its data. This includes disclosure of sensitive information, modification of data, and disruption of service [1].

Mitigation

Adobe has released security patches to address this vulnerability. Affected users should upgrade to Magento Commerce 2.4.3 or later, or apply the relevant security patches as indicated in Adobe's security bulletin. No workarounds are documented in the available references [1].