CVE-2021-36028 : Security Advisory and Response

Magento Commerce versions 2.4.2, 2.4.2-p1, and 2.3.7 are affected by an XML Injection vulnerability allowing remote code execution by an attacker with admin privileges. The vulnerability was published on August 10, 2021, by Adobe.

Understanding CVE-2021-36028

This section delves into the details of the Magento Commerce XML Injection vulnerability and its potential impact.

What is CVE-2021-36028?

The vulnerability in Magento Commerce versions <= 2.4.2, <= 2.4.2-p1, and <= 2.3.7 enables an attacker to execute remote code via a specially crafted script when saving a configurable product.

The Impact of CVE-2021-36028

With a CVSS base score of 9.1 (Critical), the vulnerability has high confidentiality and integrity impacts. An attacker can achieve remote code execution with admin privileges, leading to a changed scope and high availability impact.

Technical Details of CVE-2021-36028

This section provides further technical insights into the CVE-2021-36028 vulnerability.

Vulnerability Description

The XML Injection vulnerability allows attackers to execute remote code on affected Magento Commerce instances, compromising the security and integrity of the system.

Affected Systems and Versions

Magento Commerce versions 2.4.2, 2.4.2-p1, and 2.3.7 are confirmed to be impacted by this vulnerability, posing a significant risk to systems with the specified versions.

Exploitation Mechanism

By triggering a specially crafted script when saving a configurable product, an attacker with admin privileges can exploit this vulnerability to achieve remote code execution.

Mitigation and Prevention

To safeguard systems against CVE-2021-36028, immediate actions and long-term security practices are recommended.

Immediate Steps to Take

Update Magento Commerce to the latest patched version immediately.
Implement strong access controls to limit admin privileges.

Long-Term Security Practices

Regularly monitor and audit admin activities to detect suspicious behavior.
Conduct security training for admins to increase awareness of potential threats.

Patching and Updates

Stay informed about security updates and patches released by Adobe for Magento Commerce to prevent exploitation of known vulnerabilities.