Adobe Commerce post-auth improper input validation leads to remote code execution

Vulnerability

Description CVE-2022-24093 is an improper input validation vulnerability affecting Adobe Commerce versions 2.4.3-p1 and earlier, as well as 2.3.7-p2 and earlier. The root cause lies in insufficient sanitization of user-supplied input, which can lead to arbitrary code execution by an authenticated attacker [1].

Exploitation

Exploitation requires authentication to the Adobe Commerce backend but does not require any user interaction. An attacker with admin-level or other privileged access could craft specially malformed input that bypasses validation, triggering code execution on the server [1]. The attack surface is limited to authenticated users, reducing the pool of potential attackers to those with valid credentials.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying server. This could lead to full compromise of the Adobe Commerce instance, including data theft, modification, or denial of service. The CVSS v3.1 base score is 9.9 (Critical) due to the high impact on confidentiality, integrity, and availability combined with the low attack complexity and no user interaction requirement [1].

Mitigation

Adobe has released security patches to fix this vulnerability in later versions of Adobe Commerce and Magento Open Source. Users are strongly advised to upgrade to a patched version. No workarounds have been publicly documented; applying the vendor-supplied patch is the recommended course of action [2].