Is CVE-2016-4010 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-4010 being exploited in the wild.

How severe is CVE-2016-4010?

Critical severity, with a CVSS score of 9.8, published 23 January 2017.

Which products and versions are affected?

Adobe Magento Community Edition before 2.0.6; Adobe Magento Enterprise Edition before 2.0.6.

Is there a fix for CVE-2016-4010?

A patch was published on 2016-05-17: Magento 2.0.6 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-4010 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2016-4010?

Check whether you run Adobe Magento Community Edition or Adobe Magento Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-4010: Magento PHP object injection in Web API shopping cart data

CVE-2016-4010 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Magento, a widely used e-commerce platform, contains a critical vulnerability that allows unauthorized individuals to take complete control of an online store. By sending specially crafted data to the website's shopping cart or API components, an attacker can execute malicious code on the server. This could lead to the theft of sensitive customer information, financial data, or a total shutdown of the online storefront.

Technologies: Adobe Magento Enterprise Edition. Vendors: Adobe.

Quick answers

Is CVE-2016-4010 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-4010 being exploited in the wild.
How severe is CVE-2016-4010?: Critical severity, with a CVSS score of 9.8, published 23 January 2017.
Which products and versions are affected?: Adobe Magento Community Edition before 2.0.6; Adobe Magento Enterprise Edition before 2.0.6.
Is there a fix for CVE-2016-4010?: A patch was published on 2016-05-17: Magento 2.0.6 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-4010 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2016-4010?: Check whether you run Adobe Magento Community Edition or Adobe Magento Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Magento CE and EE versions prior to 2.0.6 are susceptible to a PHP object injection vulnerability. The flaw exists in how the Web API (REST and SOAP) handles serialized data, specifically within the shopping cart component. An unauthenticated remote attacker can exploit this by sending a crafted request containing malicious serialized objects to an exposed API method that requires only 'anonymous' privileges. When the application unserializes this data, it can be leveraged to achieve arbitrary file writes or remote code execution (RCE) by triggering 'magic methods' in available PHP classes. This vulnerability was addressed in the Magento 2.0.6 security update.

Affected products

Magento (Adobe) Magento Community Edition before 2.0.6
Magento (Adobe) Magento Enterprise Edition before 2.0.6

Timeline

2016-05-17: disclosed: Initial public disclosure by researcher Netanel Rubin
2016-05-18: other: Exploit code published on Exploit-DB
2016-05-17: patched: Magento 2.0.6 released to address the vulnerability
2017-01-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.