Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2, 2.4.2-p1, and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the configurable product saving functionality. An attacker with admin privileges can inject malicious XML to trigger a specially crafted script. [1]

Exploitation

The attacker must have admin privileges on the Magento Commerce instance. The exploitation involves saving a configurable product with a specially crafted payload that exploits the XML Injection. The exact sequence of steps is not disclosed in the available references. [1]

Impact

Successful exploitation allows the attacker to achieve remote code execution with admin privileges, leading to full compromise of the application's confidentiality, integrity, and availability. [1]

Mitigation

No specific patch version or workaround is provided in the available references. Users should monitor Adobe security advisories for updates and consider upgrading to a patched version if available. [1]