CVE-2023-29291: Magento Community Edition SSRF Vulnerability Leading to Arbitrary File System Read
Summary
CVE-2023-29291: Magento Open Source allows Server-Side Request Forgery (SSRF). Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p4
>= 2.4.5-p1, < 2.4.5-p3
Fixed in 2.4.4-p4 or 2.4.5-p3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Community Edition have been found to be vulnerable to a Server-Side Request Forgery (SSRF) attack, which can compromise the security of the application.
Vulnerability Detail
The vulnerability identified as CVE-2023-29291 affects Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier. It allows an authenticated attacker with admin privileges to exploit the application by injecting arbitrary URLs, leading to unauthorized access to the file system. This SSRF vulnerability can result in sensitive data exposure and potential system compromise, as it enables attackers to make arbitrary requests from the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p42.4.4-p4composer require magento/community-edition:2.4.4-p4 -
>= 2.4.5-p1, < 2.4.5-p32.4.5-p3composer require magento/community-edition:2.4.5-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the server and limit the ability of authenticated users to make requests to internal resources. This can help minimize the risk of exploitation until the package is updated.
Conclusion
The CVE-2023-29291 vulnerability poses a significant risk to Magento Community Edition users, allowing for SSRF attacks that can lead to unauthorized file system access. It is essential to update to the latest patched versions to secure your application and protect sensitive data.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-29291 is a vulnerability in Magento Community Edition that allows for Server-Side Request Forgery (SSRF), potentially leading to unauthorized file system access.
Affected versions include Adobe Commerce 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 4.9, indicating a moderate level of severity.
If immediate updating is not possible, implement access restrictions for authenticated users to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
