Critical Magento zero-day vulnerability actively exploiting multiple e-commerce websites

Threat Level – Amber | Vulnerability Report

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here

Adobe issued an emergency advisory informing Adobe Commerce and Magento Open-Source product users of a critical zero-day vulnerability that is being actively exploited in the wild.

A zero-day vulnerability which has been assigned CVE-2022-24086 affects the Adobe Commerce and Magento Open-Source products as they fail to properly validate the user input. A pre-authenticated attacker can exploit this to execute arbitrary code on the victim’s machine. This vulnerability is being exploited in the wild and targeting Adobe Commerce merchants.

Only three days later, Adobe updated same security advisory for the new vulnerability which is related to the earlier reported zero-day vulnerability (CVE-2022-24086) and assigned it CVE-2022-24087. This update has been issued for a new vulnerability that fixes the zero-day vulnerability’s incomplete patch.

Hive Pro threat research team advices organizations to patch these vulnerabilities as soon as possible using the patch links below.

Potential MITRE ATT&CK TTPs are:

TA0001: Initial Access

TA0002: Execution

TA0003: Persistence

TA0004: Privilege Escalation

TA0005: Defense Evasion

T1190: Exploit Public-Facing Application

T1078: Valid Accounts T1068: Exploitation for Privilege Escalation