CVE-2014-8770: MAGMI plugin for Magento Unsafe File Upload
Summary
CVE-2014-8770: MAGMI plugin for Magento Unsafe File Upload. Affects dweeves/magmi versions < 0.7.17a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The MAGMI (Magento Mass Importer) plugin is a tool used for bulk importing and updating products in Magento Community Edition (CE). It provides a web interface for uploading and processing data in various formats. The plugin is widely used by Magento administrators to streamline the product management process.
Vulnerability Detail
The MAGMI plugin version 0.7.17a and earlier for Magento CE is vulnerable to an unrestricted file upload vulnerability. This vulnerability allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file. The uploaded PHP file can then be accessed and executed by making a direct request to it in the 'magmi/plugins/' directory. This can lead to remote code execution and compromise of the affected Magento installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can disable the MAGMI plugin or restrict access to the 'magmi/plugins/' directory. This can help mitigate the risk of remote code execution through the file upload vulnerability. However, it is strongly advised to apply the official fix or upgrade to a patched version as soon as possible.
Conclusion
The MAGMI plugin for Magento CE is vulnerable to an unrestricted file upload vulnerability that can lead to remote code execution. It is crucial for Magento administrators to apply the necessary fixes or upgrades to protect their installations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dweeves/magmi →
FAQ
This vulnerability allows remote authenticated users to upload and execute arbitrary PHP code on the affected Magento installation. This can lead to complete compromise of the system, unauthorized access to sensitive data, and potential disruption of business operations.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any known vulnerabilities, including this one.
Yes, there have been reports of active exploits targeting this vulnerability. Attackers can upload malicious PHP files and execute arbitrary code on vulnerable Magento installations. It is crucial to apply the necessary fixes or upgrades to protect your system.
Yes, this vulnerability can be exploited remotely by authenticated users. Attackers can upload a specially crafted ZIP file containing a malicious PHP file and then access it directly to execute arbitrary code on the server.
Yes, a patched version of the MAGMI plugin is available to address this vulnerability. It is recommended to upgrade to the latest version of the plugin to ensure the security of your Magento installation.
Related vulnerabilities
Recent vulnerabilities recorded for dweeves/magmi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
