Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in a GraphQL field. The bug allows an unauthenticated attacker to supply specially crafted input that the server does not properly sanitize, leading to resource exhaustion or crash [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a malicious GraphQL query to a vulnerable Magento instance. No prior authentication or special network position beyond network access to the GraphQL endpoint is required. The attacker crafts a request that triggers the input validation flaw, causing the server to allocate excessive resources or enter an infinite processing loop [1].

Impact

Successful exploitation results in a server-side denial-of-service condition. The attacker can cause the Magento application to become unresponsive, effectively denying service to legitimate users. No data confidentiality or integrity is compromised directly, but availability is impacted [1].

Mitigation

Adobe released patches as part of Magento Commerce 2.4.3 and 2.3.7-p1 on July 29, 2021. Users should upgrade to these fixed versions immediately. There are no known workarounds for this vulnerability. Magento Commerce 2.4.2 and earlier are no longer supported and should be upgraded to a supported version [1][2].