Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution

Vulnerability

CVE-2021-36033 is an XML Injection vulnerability in the Widgets Module of Magento Commerce (Adobe Commerce). Affected versions include 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) [1]. The vulnerability allows an attacker with admin privileges to inject malicious XML content that is processed by the application, leading to arbitrary code execution. The issue resides in insufficient sanitization of user-supplied XML data within the Widgets Module, which is reachable when an admin user configures or interacts with widget-related functionalities.

Exploitation

To exploit this vulnerability, an attacker must have administrative privileges on the Magento Commerce instance. With those privileges, the attacker can trigger a specially crafted script, likely by submitting malicious XML input through the admin panel’s Widgets Module configuration or a similar interface [1]. The injected XML payload is then parsed and executed by the server, resulting in remote code execution. No additional user interaction is required beyond the admin’s actions, and the attack can be carried out without requiring any special network position if the admin panel is accessible.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the underlying server with the privileges of the Magento application process. This leads to full compromise of confidentiality, integrity, and availability (CIA) of the affected system, including potential exfiltration of sensitive data (e.g., customer information, payment data), modification of store content, and disruption of services [1]. The attacker effectively gains control over the eCommerce platform.

Mitigation

Adobe has released security patches for this vulnerability. The fix is included in Magento Commerce versions 2.4.3, 2.4.2-p2, and 2.3.7-p1, which were released on September 14, 2021 [1]. Users are strongly advised to upgrade to these or later versions immediately. No workaround is available for unpatched installations. This vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of this writing.