Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Root

Cause

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [1]. The flaw stems from insufficient sanitization of special elements that can be merged into operating system commands, allowing an authenticated administrator to inject arbitrary commands [1].

Exploitation

An attacker must first gain administrative access to the Adobe Commerce application. Exploitation requires user interaction, meaning the administrator must perform a specific action, such as clicking a link or submitting a crafted request, for the attack to succeed [1]. The vulnerability's scope is changed, indicating the impact can extend beyond the vulnerable component (e.g., affecting adjacent network resources or other application components). [1]

Impact

Successful exploitation enables an admin attacker to execute arbitrary OS commands on the underlying server, leading to arbitrary code execution and full compromise of the affected system [1]. The attacker could install persistent backdoors, alter or exfiltrate data, or pivot to other internal systems depending on the deployment architecture.

Mitigation

Adobe has released security patches that address this vulnerability in versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9 [1]. Users running earlier versions are advised to upgrade immediately. As a defense-in-depth measure, organizations should restrict admin interface access to trusted IPs and enforce multi-factor authentication for admin accounts.