CVE-2024-45120: Magento Community Edition Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Summary
CVE-2024-45120: Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a leading open-source e-commerce platform that enables businesses to create and manage online stores. It offers a wide range of features including product management, customer management, and order processing. However, like any software, it is susceptible to vulnerabilities that can compromise its integrity and security. The specific vulnerability in question is a Time-of-check Time-of-use (TOCTOU) race condition, which can lead to security feature bypasses, affecting the integrity of the application.
Vulnerability Detail
The vulnerability arises from a race condition that occurs between the time a security check is performed and the time a resource is used. This flaw allows an attacker to alter a condition in this window, potentially bypassing security features. The impact on integrity is considered low, but exploitation requires user interaction, making it a moderate risk. Affected versions include Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, ensure that user interactions that could trigger the vulnerability are closely monitored and controlled. Implement additional logging to track any suspicious activities during the time of resource checks.
Conclusion
The CVE-2024-45120 vulnerability in Magento Community Edition represents a moderate risk due to a TOCTOU race condition that can lead to security feature bypasses. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for magento/community-edition →
FAQ
A TOCTOU (Time-of-check Time-of-use) vulnerability occurs when a system checks a condition and then uses the resource, allowing an attacker to change the resource in between these two actions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signup.
Exploitation of this vulnerability could lead to a security feature bypass, potentially allowing unauthorized access or manipulation of resources, although the impact on integrity is considered low.
Yes, exploitation of this vulnerability requires user interaction, which means an attacker would need to trick a user into performing an action that triggers the vulnerability.
If immediate updates are not possible, implement strict monitoring and logging of user interactions and consider restricting access to sensitive functionalities until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
