Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution

Vulnerability

A path traversal vulnerability exists in Magento Commerce versions 2.4.2, 2.4.2-p1, and 2.3.7 (and earlier) through the theme[preview_image] parameter. An attacker with admin privileges can manipulate this parameter to traverse directories and upload malicious files, leading to remote code execution [1].

Exploitation

To exploit, an attacker must have admin privileges to access the parameter. By crafting a request with path traversal sequences (e.g., ../) in theme[preview_image], the attacker can write files outside the intended directory. Uploading a malicious PHP file enables arbitrary code execution on the server [1].

Impact

Successful exploitation allows remote code execution with the privileges of the web server user, potentially leading to full site compromise, data exfiltration, and further attacks [1].

Mitigation

Adobe released security updates fixing this vulnerability. Users should upgrade to Magento Commerce 2.4.3, 2.4.2-p2, or 2.4.1-p1 (or later versions). For Magento Open Source, apply the latest patches [2].