Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) contain an improper input validation vulnerability [1]. The flaw exists in the file upload functionality, where a specially crafted file can bypass validation checks when an attacker has administrative privileges.

Exploitation

An attacker with admin panel access can upload a malicious file, such as a PHP script, through the vulnerable upload mechanism. The lack of proper input validation allows the file to be stored and executed on the server, leading to remote code execution [1].

Impact

Successful exploitation results in remote code execution, enabling the attacker to fully compromise the Magento Commerce instance, including access to sensitive data, modification of configurations, and potential lateral movement within the infrastructure.

Mitigation

Adobe has not provided specific mitigation details in the available references [1]. Users should upgrade to the latest supported version of Magento Commerce (2.4.3 or later) as recommended by Adobe, which includes security fixes for this vulnerability.