Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension [1]. The extension fails to properly validate the type or content of uploaded files, allowing an authenticated attacker with Admin privileges to bypass restrictions and upload arbitrary files [1].

Exploitation

An attacker must first obtain administrative credentials for the Magento Commerce instance [1]. With Admin privileges, the attacker can craft a specially crafted HTTP request to the vulnerable API endpoint that handles file uploads for product options. By sending a malicious file (e.g., a PHP web shell) instead of the expected image or document type, the attacker can trigger the upload of this arbitrary file to the server [1]. No additional user interaction or race condition is required; the vulnerability is directly accessible via the administrative API.

Impact

Successful exploitation results in unrestricted file upload, which can lead to remote code execution (RCE) on the underlying server [1]. An attacker can then execute arbitrary commands, install backdoors, exfiltrate sensitive data, or further compromise the Magento installation and connected systems. The impact is high, as the attacker gains full control with the privileges of the web server user.

Mitigation

Adobe has released security patches for this vulnerability. Users should upgrade to Magento Commerce 2.4.3 or later, which contains the fix [1]. For users on affected versions (2.3.7, 2.4.2, 2.4.2-p1), upgrading to the latest available patched release is the only complete mitigation. No workaround has been provided by the vendor. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.