Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Vulnerability

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier), and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability in the Wishlist Share Link feature. The vulnerability arises when a user clicks a malicious link crafted by an attacker, which triggers unauthorized actions on behalf of the authenticated user. No admin access is required for the vulnerable code path to be reachable [1].

Exploitation

An unauthenticated attacker can exploit this CSRF vulnerability by tricking a logged-in user into clicking a specially crafted link. The link leverages the Wishlist Share functionality to send a request that adds items to the victim's cart. No special network position or authentication is needed other than the victim being logged into their Adobe Commerce store [1].

Impact

Successful exploitation allows the attacker to add items to the victim's shopping cart without the victim's consent. This could lead to unwanted items being included in the cart, potentially resulting in unintended purchases or manipulation of the checkout process. The attacker gains no additional privileges beyond cart manipulation [1].

Mitigation

Not yet disclosed in the available references [1]. Users should monitor Adobe Security Bulletins for updates and apply any released patches as soon as possible.