CVE-2023-22247: Magento Open Source XML Injection Vulnerability
Summary
CVE-2023-22247: Magento Open Source allows XML Injection. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p3
>= 2.4.5-p1, < 2.4.5-p2
Fixed in 2.4.4-p3 or 2.4.5-p2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento are vulnerable to an XML Injection issue that can compromise the security of the application.
Vulnerability Detail
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability. This flaw allows an unauthenticated attacker to inject arbitrary URLs, leading to arbitrary file system reads. The exploitation of this vulnerability does not require user interaction, making it particularly dangerous. The vulnerability is classified under CWE-91, which pertains to XML Injection.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p32.4.4-p3composer require magento/community-edition:2.4.4-p3 -
>= 2.4.5-p1, < 2.4.5-p22.4.5-p2composer require magento/community-edition:2.4.5-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the affected components of the application until the patch can be applied. This may involve modifying server configurations or using firewall rules to limit access.
Conclusion
The XML Injection vulnerability in Magento Open Source poses a significant risk to users of affected versions. It is crucial to update to the patched versions to mitigate this risk. Regular monitoring and vulnerability assessments, such as those provided by Vulert, can help maintain the security of your applications.
See every vulnerability recorded for magento/community-edition →
FAQ
XML Injection is a type of attack where an attacker injects malicious XML code into an application, potentially leading to unauthorized access or data manipulation.
You can check your Magento version and compare it with the affected versions listed in the vulnerability details. Additionally, you can use Vulert to monitor and alert for vulnerabilities in your software.
Exploitation of this vulnerability can lead to unauthorized file system access, potentially exposing sensitive data or allowing further attacks on the system.
No, exploitation does not require user interaction, making it easier for attackers to exploit the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
