{"uuid": "f4beda87-062c-48a1-9d44-0df9f8f2d017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24086", "type": "exploited", "source": "https://t.me/hacking_Attack/42868", "content": "Black Hat Ethical Hacking\nAdobe: Zero-Day Magento 2 RCE Bug Under Active Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Adobe: Zero-Day Magento 2 RCE Bug Under Active AttackPost Views: 166 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes\nA zero-day remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms has been actively exploited in the wild. \nThe security vulnerability bug (CVE-2022-24086) is a critical affair, allowing pre-authentication RCE arising from improper input validation. It scores 9.8 out of 10 on the CVSS vulnerability-severity scale, but there is one mitigating factor: An attacker would need to have administrative privileges in order to be successful.\n\nIt affects versions 2.3.7-p2 and earlier and 2.4.3-p1 and earlier of both eCommerce platforms, according to the advisory. \u00a0According to SanSec, which did a deeper dive into patching bug on Magento, the following should be taken into consideration:\n\n* If you are running Magento 2.3 or 2.4, install the custom patch from Adobe ASAP, ideally within the next few hours;\n* If you are running a version of Magento 2 between 2.3.3 and 2.3.7, you should be able to manually apply the patch, as it only concerns a few lines;\n* And, if you are running Magento 2.3.3 or below, you are not directly vulnerable. However, SanSec still recommends manually implementing the given patch.\n\nSanSec noted on Monday\u00a0that the bug came to light on Jan. 27, and that \u201cthis vulnerability has a similar severity as the Magento Shoplift vulnerability\u00a0from 2015. At that time, nearly all unpatched Magento stores globally were compromised in the days after the exploit publication.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nResearchers noted on Monday that patching need not be onerous:\\\n\n \nIf you have the time, follow the instructions to patch your #magento 2 store with the guide from @avstudnitz.\n\nIf you don't have the time? Do the quick and dirty patch described here:https://t.co/nZTlQGSBmp\n\nIt will take you less than 5 minutes, but you _have_ to patch today! https://t.co/gkhT07QgbA pic.twitter.com/7NqJMV3qzb\n\n\u2014 willem wigman (@willemwigman) February 14, 2022\nSee Also: Windows vulnerability with new public exploits lets you become admin Update ASAP to Stave Off AttacksIndeed, updating is important for online merchants: The Magecart group famously targets\u00a0unpatched versions of Magento in particular, looking for a way to plant credit-card skimmers on the checkout pages of eCommerce websites.\n\nThe threat actor, which is actually a consortium of many different card-harvesting subgroups, consistently evolves its skimmers to be more effective and efficient at evasion as well. For instance, in November, it added an extra browser process\u00a0that uses the WebGL JavaScript API to check a user\u2019s machine to ensure it\u2019s not running on a virtual machine \u2013 thus evading researcher detection. And in January, an attack on Segway involved planting the skimmer by using a favicon\u00a0that traditional security systems wouldn\u2019t inspect.\n\nFor now, Adobe characterized the attacks as \u201cvery limited.\u201d But card-skimmer activity is on the rise, and updates on the part of website owners seem sparse. Last week, SanSec reported a wave of skimming\u00a0attacks targeting more than 500 sites, in particular those using outdated and unsupported Magento 1 implementations.\u00a0Further data from Source Defense\u00a0found as many as 50,000 to 100,000 sites that are using the end-of-life Magento 1. See Also: Offensive Security Tool: Stratus Red Team\n\u201cMagento and other eCommerce platforms have a long histo[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T08:00:06.549309Z"}