Adobe fixes two critical bugs impacting its Magento e-commerce platform

The company is advising users to update their installation to the newest version as soon as possible

Adobe said on Thursday that its Magento e-commerce platform is affected by nine security vulnerabilities, including two critical bugs, which could allow hackers to execute arbitrary code on vulnerable systems as well as gain read or write access to the database.

Both Magento Commerce and Magento Open Source platforms are affected by these bugs, the company revealed.

According to Adobe, two of the nine vulnerabilities are rated as 'Critical', six are 'Important' while one is 'Moderate' in severity.

The most severe of these bugs is CVE-2020-24407, an arbitrary code execution (RCE) vulnerability which could allow a remote authenticated user with administrator privileges to upload a malicious file via the internet and execute it on the server.

The vulnerability exists due to insufficient validation of file during file upload. Attackers exploiting the flaw would not need pre-authentication, although, they would need administrative privileges.

Adobe said that it was not aware of any malware exploiting this vulnerability at the present time.

CVE-2020-24400 is the second critical SQL injection vulnerability that arises due to insufficient sanitisation of user-supplied data. A remote privileged user can exploit this bug by sending a specially crafted request to the affected application in order to gain arbitrary read/write access to a database.

Adobe has also fixed a cross-site scripting (Stored XSS) vulnerability, indexed as CVE-2020-24408, which could allow arbitrary JavaScript execution in the browser.

Other bugs patched by Adobe in its security update include CVE-2020-24401, CVE-2020-24403 and CVE-2020-24405 (three flaws that could allow unauthorised access to restricted resources); CVE-2020-24402 (unauthorised modification of customer list); CVE-2020-24404 (unauthorised modification of Magento CMS pages); CVE-2020-24406 (disclosure of document root path);

According to Adobe, the versions affected by these security bugs are:

The company is advising users to update their installation to the newest version as soon as possible.

Magento, which was acquired by Adobe last year, is one of the most popular e-commerce platforms in the world. It provides widely used e-commerce software on both an open source and commercial basis.

Magento Marketplace portal is currently used by thousands of people to buy, sell, and download themes and plugins for Magento-based online stores.

However, the popularity of Magento has also led to this platform being persistently targeted by cyber criminals.

Last month, researchers from Dutch cyber security firm Sanguine Security (Sansec) said that they have uncovered a massive MageCart campaign in which private information of users in over 2,000 Magento stores was compromised.

The researchers said that most of the compromised stores were running Magento 1 version, which reached the end of support in June 2020.

In November 2019, Adobe disclosed a security breach that exposed confidential information of a large number of Magento Marketplace users. The company said that an unknown group of hackers exploited a security flaw on the Magento website to access the account details of registered buyers as well as sellers. The information compromised included usernames, phone number, email addresses, MageID (store usernames), billing addresses, shopping addresses, and limited commercial information.

Researchers at security firm Sucuri also uncovered a critical vulnerability in Magento last year, which left nearly 300,000 online retailers at risk of card-skimming attacks.