Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an improper input validation vulnerability [1]. The vulnerability allows an attacker with admin privileges to upload a specially crafted file that bypasses file extension restrictions.

Exploitation

An attacker must have administrative access to the Magento Commerce instance. The attacker then uploads a file with a malicious payload and a crafted extension that is not properly validated, bypassing the intended restrictions [1]. No user interaction is required beyond the admin privileges.

Impact

Successful exploitation allows the attacker to perform remote code execution on the underlying server [1]. This could lead to full compromise of the affected system and data exfiltration or destruction.

Mitigation

Not yet disclosed in the available references. Users are advised to check Adobe's official security bulletins for updates. [1]