PT-2015-6239 · Magento · Magento Community Edition+1

Publicado 2015-04-29 · Atualizado 2016-12-06 · CVE-2015-3458

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magento Community Edition (CE) version 1.9.1.0 Magento Enterprise Edition (EE) version 1.14.1.0

Description The issue is related to the fetchView function in the Mage Core Block Template Zend class, which does not restrict the stream wrapper used in a template path. This allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. It is unclear whether this issue crosses privilege boundaries, as administrators may already have privileges to include arbitrary files.

Recommendations For Magento Community Edition (CE) version 1.9.1.0, consider restricting access to the fetchView function in the Mage Core Block Template Zend class until a patch is available. For Magento Enterprise Edition (EE) version 1.14.1.0, consider restricting access to the fetchView function in the Mage Core Block Template Zend class until a patch is available. As a temporary workaround, consider disabling the use of the phar:// stream wrapper in template paths to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-3458

Produtos afetados

Magento Community Edition

Magento Enterprise Edition

Referências · 6

• 🔥 http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3458 · Nota
• http://securitytracker.com/id/1032230 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3458 · Nota de Segurança
• http://securityfocus.com/bid/74412 · Nota
• http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability · Aviso do Fabricante