CVE-2023-26366: Magento Community Edition Server-Side Request Forgery Vulnerability
Summary
CVE-2023-26366: Magento Open Source allows Server-Side Request Forgery (SSRF). Affects magento/community-edition across 4 version ranges.
>= 2.4.4-p1, < 2.4.4-p6
>= 2.4.5-p1, < 2.4.5-p5
>= 2.4.6-p1, < 2.4.6-p3
>= 2.4.7-beta1, < 2.4.7-beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible shopping cart system, control over the look, content, and functionality of online stores. It is designed for scalability and offers a variety of features including product management, customer management, and order management. However, certain versions of Magento Community Edition are susceptible to a Server-Side Request Forgery (SSRF) vulnerability, which can lead to unauthorized access to sensitive files.
Vulnerability Detail
The SSRF vulnerability in Magento allows high-privileged authenticated attackers to manipulate the application into making arbitrary requests to internal services or resources. This can lead to unauthorized file system reads, potentially exposing sensitive information. The vulnerability arises from improper validation of user-supplied URLs, enabling attackers to inject malicious URLs that the application will process without user interaction. The affected versions include 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p62.4.4-p6composer require magento/community-edition:2.4.4-p6 -
>= 2.4.5-p1, < 2.4.5-p52.4.5-p5composer require magento/community-edition:2.4.5-p5 -
>= 2.4.6-p1, < 2.4.6-p32.4.6-p3composer require magento/community-edition:2.4.6-p3 -
>= 2.4.7-beta1, < 2.4.7-beta22.4.7-beta2composer require magento/community-edition:2.4.7-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the application by implementing network security controls or firewall rules that limit outbound requests to only trusted domains. However, this is not a permanent solution and updating to a patched version is strongly recommended.
Conclusion
The SSRF vulnerability in Magento Community Edition poses a significant risk to users, allowing attackers to exploit the application for unauthorized file access. It is essential to update to the latest patched versions to mitigate this risk effectively. Implementing security measures and using tools like Vulert can help monitor and manage vulnerabilities in your applications.
See every vulnerability recorded for magento/community-edition →
FAQ
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access to sensitive data.
The affected versions include Magento Community Edition 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updating is not possible, consider implementing network security measures to restrict outbound requests until you can apply the necessary updates.
The CVSS score of this vulnerability is 6.8, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
