Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure

Vulnerability

An improper input validation vulnerability exists in the Multishipping Module of Magento Commerce. Affected versions are 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) [1]. The flaw resides in the way the module handles user-supplied input, allowing an authenticated attacker to bypass intended validation checks [1].

Exploitation

An attacker must be authenticated to the Magento Commerce instance. No specific user role or privilege beyond authentication is required from the available descriptions [1]. The exact exploitation steps are not detailed in the available references, but the attacker would send crafted requests to the Multishipping Module endpoint, exploiting the missing input validation to trigger sensitive data exposure [1].

Impact

Successful exploitation leads to sensitive information disclosure [1]. The type of information exposed is not specified in the available references, but it could include customer data, order details, or internal configuration values. The confidentiality impact is the primary consequence, with no indication of integrity or availability compromise [1].

Mitigation

Adobe released security patches for this vulnerability. For Magento Commerce 2.4.2 and 2.4.2-p1, upgrade to version 2.4.3 or later. For 2.3.7, upgrade to version 2.3.8 or later. The fixed releases were made available on September 1, 2021 [1]. No workarounds are documented in the provided references [1].