Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Root

Cause Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an OS command injection flaw [1]. The software fails to properly neutralize special elements in user-supplied input before passing it to a system shell, allowing an attacker to inject arbitrary operating system commands.

Exploitation

The vulnerability is exploitable remotely without requiring user interaction [1]. An attacker can send a crafted request to the vulnerable Magento instance, bypassing authentication if necessary (though specific prerequisites are not detailed). No user action is needed for the attack to succeed.

Impact

Successful exploitation leads to arbitrary code execution on the underlying server [1]. An attacker can gain full control of the affected system, potentially leading to data exfiltration, malware deployment, or further lateral movement within the network.