CVE-2023-29297: Magento Community Edition Arbitrary Code Execution Vulnerability
Summary
CVE-2023-29297: Magento Open Source allows Improper Neutralization of Special Elements Used. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p4
>= 2.4.5-p1, < 2.4.5-p3
Fixed in 2.4.4-p4 or 2.4.5-p3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Community Edition is an open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It offers a wide range of features including product management, customer management, and order processing. However, certain versions of Magento are vulnerable to an issue that allows an authenticated attacker with admin privileges to execute arbitrary code, compromising the integrity and security of the application.
Vulnerability Detail
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) are affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. This flaw can be exploited by an authenticated attacker with admin privileges to execute arbitrary code without requiring user interaction. The vulnerability arises from insufficient validation of user input, which can lead to severe consequences including unauthorized access to sensitive data and complete system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p42.4.4-p4composer require magento/community-edition:2.4.4-p4 -
>= 2.4.5-p1, < 2.4.5-p32.4.5-p3composer require magento/community-edition:2.4.5-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the admin panel to trusted IP addresses only. This can be done by configuring your web server settings to allow access from specific IPs, thereby reducing the risk of exploitation.
Conclusion
CVE-2023-29297 poses a significant risk to Magento Community Edition users, allowing authenticated attackers to execute arbitrary code. It is crucial to update to the latest patched versions to mitigate this vulnerability. Additionally, consider implementing access restrictions as a temporary measure until the update can be applied.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-29297 is a vulnerability in Magento Community Edition that allows authenticated attackers with admin privileges to execute arbitrary code.
Adobe Commerce versions 2.4.6, 2.4.5-p2, and 2.4.4-p3 and earlier versions are affected by this vulnerability.
The CVSS score for this vulnerability is 9.1, indicating a high severity level that could lead to significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, restrict access to the admin panel to trusted IP addresses as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
