Magento up to 2.2.9/2.3.2 Xpath GET Request xml injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Magento up to 2.2.9/2.3.2. This affects an unknown function of the component Xpath Handler. Such manipulation as part of GET Request leads to xml injection. This vulnerability is documented as CVE-2019-8158. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Magento up to 2.2.9/2.3.2 and classified as critical. Affected by this issue is an unknown functionality of the component Xpath Handler. The manipulation as part of a GET Request leads to a xml injection vulnerability. Using CWE to declare the problem leads to CWE-91. The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.

The weakness was released 11/06/2019. This vulnerability is handled as CVE-2019-8158 since 02/12/2019. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 2.2.10, 2.3.2-p1 or 2.3.3 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-145075, VDB-145074, VDB-145073 and VDB-145072. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• Magento

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.3.0
• 2.3.1
• 2.3.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion