Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Vulnerability

Overview

CVE-2024-39401 is an Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier [1]. The root cause is the application's failure to properly sanitize special elements when handling input that is used to construct OS commands, allowing an attacker to inject arbitrary commands this way.

Exploitation and

Attack Surface

The vulnerability requires an attacker to have administrative privileges on the targeted Adobe Commerce instance [1]. Additionally, exploitation requires user interaction, meaning another user must perform an action that triggers the injected command [1]. The attack scope is changed, indicating the injected command can affect resources beyond the vulnerable component. No other prerequisites such as network proximity or specific configuration are noted.

Impact

Successful exploitation of this OS command injection vulnerability allows an attacker to execute arbitrary code on the underlying server [1]. This can lead to full compromise of the affected system, including data exfiltration, modification of site content, credential theft, or further lateral movement within the network.

Mitigation

Status

Adobe has not released a patch as of the publication date. Users are advised to apply vendor-supplied updates once they become available, monitor vendor advisories, and restrict administrative access to trusted users [1]. This CVE has not yet been added to the Known Exploited Vulnerabilities (KEV) catalog.