CVE-2019-8151: Magento Server-Side Request Forgery (SSRF)
Summary
CVE-2019-8151: Magento Server-Side Request Forgery (SSRF). Affects magento/community-edition across 2 version ranges.
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.2-p2
Fixed in 2.2.10 or 2.3.2-p2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It offers various features such as product management, order processing, and customer management. The vulnerability in question affects Magento versions 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. This vulnerability allows an authenticated user with admin privileges to manipulate shipment settings and execute arbitrary code through server-side request forgery due to unsafe handling of a carrier gateway.
Vulnerability Detail
The vulnerability arises from the insecure handling of a carrier gateway in Magento. An attacker with admin privileges can exploit this vulnerability to execute arbitrary code by manipulating shipment settings. This can lead to remote code execution and potential compromise of the affected Magento instance. The impact of this vulnerability is significant, as it allows an authenticated attacker to bypass security measures and gain unauthorized access to the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.102.2.10composer require magento/community-edition:2.2.10 -
>= 2.3.0, < 2.3.2-p22.3.2-p2composer require magento/community-edition:2.3.2-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest patched version of Magento.
Conclusion
In conclusion, the Magento Server-Side Request Forgery (SSRF) vulnerability (CVE-2019-8151) poses a significant risk to Magento instances running versions 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1. It is crucial to upgrade to the latest patched version of Magento to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
The vulnerability allows an authenticated attacker to execute arbitrary code, potentially leading to remote code execution and compromise of the affected Magento instance.
Magento versions 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1 are affected by this vulnerability.
No, this vulnerability requires an authenticated user with admin privileges to exploit it.
The only known mitigation is to upgrade to the latest patched version of Magento.
Yes, the CVSS score for this vulnerability is 7.2.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
