Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) contain an improper input validation vulnerability when saving a customer's details with a specially crafted file [1]. This flaw resides in the input validation logic that fails to properly sanitize file-based input during the customer detail update process, allowing an attacker to inject malicious content through a crafted file upload.

Exploitation

An attacker must have valid admin-level credentials to access the customer detail editing functionality [1]. The attacker then uploads a specially crafted file as part of the customer details update. The improper input validation fails to reject or sanitize the malicious file content, enabling the attacker to trigger code execution on the server [1]. The attack requires no user interaction beyond the admin's own actions.

Impact

Successful exploitation grants the attacker remote code execution (RCE) on the Magento Commerce server [1]. This can lead to full compromise of the application, including data theft, modification of store configuration, and potential lateral movement within the underlying infrastructure. The attacker operates with the privileges of the Magento application user, which typically has extensive access to the file system and database.

Mitigation

Adobe has released security patches for this vulnerability. Users should upgrade to Magento Commerce 2.4.3 or later, or apply the specific patch for the relevant version as detailed in official Adobe security advisories [1]. For users on unsupported versions, upgrading to a supported, patched version is the only recommended mitigation.