UPDATE February 17: Added reference to CVE-2022-24087, which Adobe disclosed and issues an out-of-band patch for on February 17th, 2022.FortiGuard Labs is aware of reports that Magento Open Source and Adobe Commerce are actively being targeted and exploited through CVE-2022-24086. This vulnerability can lead to remote code execution (RCE) on an exploited server which means an attacker will be able to execute arbitrary commands remotely. The vulnerability is rated as Critical by Adobe and has CVSS score of 9.8 out of 10.On February 17th, Adobe released an out-of-band security fix for CVE-2022-24087. This vulnerability can also lead to remote code execution (RCE) on an exploited server which means an attacker will be able to execute arbitrary commands remotely. The vulnerability is rated as Critical by Adobe and has CVSS score of 9.8 out of 10.Why is this Significant?Since Magento and Adobe Commerce are very popular E-commerce platform across the globe, this can potentially impact a high number of online shoppers. Moreover, the attack complexity needed to carry out a successful attack has been deemed relatively low/easy and no extra privileges/permissions are required to execute this attack. A successful attack can result in the total loss of confidentiality, integrity and availability of the information and resources stored in the exploited server.In addition, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2022-24086 to the Known Exploited Vulnerabilities to Catalog, which lists vulnerabilities that “are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise.” What are CVE-2022-24086 and CVE-2022-24087? (updated on February 17th)Adobe classifies CVE-2022-24086 and CVE-2022-24087 as a vulnerability that stems from “improper input validation.” Without properly sanitizing input from a user, the input can be modified so that it executes arbitrary commands on the exploited server.What Versions of Adobe Commerce and Magento are Prone to CVE-2022-24086 and CVE-2022-24087? (updated on February 17th)The vulnerabilities exist for Adobe Commerce 2.4.3-p1 and earlier versions, as well as 2.3.7-p2 and earlier versions. For Adobe Commerce 2.3.3 and below, this vulnerabilities do not exist. The vulnerabilities exist for both Adobe Commerce and Magento Open Source versions 2.3.3-p1 to 2.3.7-p2 and from 2.4.0 to 2.4.3-p1.Are the Vulnerabilities Exploited in the Wild?FortiGuard Labs has been made aware of exploits being used in the wild for CVE-2022-24086.Has the Vendor Released a Fix?Yes. Adobe has released patches for all versions from 2.3.3-p1 to 2.3.7-p2 and from 2.4.0 to 2.4.3-p1.To be fully protected, Adobe advisory states that two patches must be applied: MDVA-43395 patch first, and then MDVA-43443 on top of it. What is the Status of Coverage? (updated on February 17th)Proof-of-Concept (POC) code is not available for both CVE-2022-24086 and CVE-2022-24087at the time of this writing and as such, no coverage is available.FortiGuard Labs is actively looking for additional information and will update this Threat Signal when protection becomes available.

Read More