Junglewise Threat Intelligence

CVE-2016-4010: Magento PHP object injection in Web API shopping cart data

CVE-2016-4010 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Technologies: Adobe Magento Enterprise Edition. Vendors: Adobe.

Executive brief

Magento, a widely used e-commerce platform, contains a critical vulnerability that allows unauthorized individuals to take complete control of an online store. By sending specially crafted data to the website's shopping cart or API components, an attacker can execute malicious code on the server. This could lead to the theft of sensitive customer information, financial data, or a total shutdown of the online storefront.

Technical details

Magento CE and EE versions prior to 2.0.6 are susceptible to a PHP object injection vulnerability. The flaw exists in how the Web API (REST and SOAP) handles serialized data, specifically within the shopping cart component. An unauthenticated remote attacker can exploit this by sending a crafted request containing malicious serialized objects to an exposed API method that requires only 'anonymous' privileges. When the application unserializes this data, it can be leveraged to achieve arbitrary file writes or remote code execution (RCE) by triggering 'magic methods' in available PHP classes. This vulnerability was addressed in the Magento 2.0.6 security update.

Affected products

  • Magento (Adobe) Magento Community Edition before 2.0.6
  • Magento (Adobe) Magento Enterprise Edition before 2.0.6

Timeline

  • 2016-05-17: disclosed: Initial public disclosure by researcher Netanel Rubin
  • 2016-05-18: other: Exploit code published on Exploit-DB
  • 2016-05-17: patched: Magento 2.0.6 released to address the vulnerability
  • 2017-01-23: advisory: NVD publication date

References