PT-2021-6287 · Adobe · Magento Commerce

Published 2021-08-11 · Updated 2022-05-24 · CVE-2021-36024

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) Magento Commerce versions 2.3.7 (and earlier)

Description The issue is caused by an improper neutralization of special elements used in a command, allowing an attacker with admin privileges to upload a specially crafted file and achieve remote code execution via the "Data collection endpoint". This is due to insufficient input validation.

Recommendations For versions 2.4.2 and earlier, and 2.4.2-p1 and earlier, consider disabling the Data collection endpoint until a patch is available. For version 2.3.7 and earlier, restrict access to the Data collection endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the Data collection endpoint until the issue is resolved.

Fix

RCE

OS Command Injection

Unrestricted File Upload

Command Injection

Weakness Enumeration

CWE-20

CWE-78

CWE-434

CWE-77

Related Identifiers

BDU:2022-01259

CVE-2021-36024

GHSA-QMQ6-JPVG-J547

Affected Products

Magento Commerce

References · 7

• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01259 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36024 · Security Note
• https://osv.dev/vulnerability/GHSA-qmq6-jpvg-j547 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36024 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://t.me/cvenotify/20502 · Telegram Post