CVE-2021-36036 Explained : Impact and Mitigation

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. This could allow an authenticated attacker with administrative privilege to gain access to delete the .htaccess file, leading to potential remote code execution.

Understanding CVE-2021-36036

This section provides insights into the nature and impact of CVE-2021-36036.

What is CVE-2021-36036?

CVE-2021-36036 is an improper access control vulnerability affecting Magento versions 2.4.2, 2.4.2-p1, and 2.3.7, allowing attackers to delete critical files and potentially execute remote code.

The Impact of CVE-2021-36036

The vulnerability could result in unauthorized access to delete crucial files by attackers with administrative privileges, leading to severe consequences such as remote code execution.

Technical Details of CVE-2021-36036

In this section, we delve into the technical aspects of the CVE-2021-36036 vulnerability.

Vulnerability Description

The vulnerability stems from an improper access control mechanism within Magento's Media Gallery Upload workflow, enabling attackers to delete the .htaccess file.

Affected Systems and Versions

Magento versions 2.4.2, 2.4.2-p1, and 2.3.7 are vulnerable to this access control issue.

Exploitation Mechanism

By uploading a specially crafted file into the website gallery, an authenticated attacker with administrative rights can exploit this vulnerability to delete the .htaccess file, potentially leading to remote code execution.

Mitigation and Prevention

To safeguard systems from CVE-2021-36036, immediate actions and long-term security strategies are essential.

Immediate Steps to Take

Update Magento to the latest version that contains patches addressing this vulnerability.
Monitor media file uploads and restrict access to critical system files.

Long-Term Security Practices

Regularly update and patch Magento installations.
Implement least privilege principles to restrict user access based on requirements.

Patching and Updates

Refer to the Adobe advisory for specific patch information and guidance to mitigate the CVE-2021-36036 vulnerability.