what you don't know can hurt you

Magento 1.9.2 File Inclusion

Magento 1.9.2 File Inclusion
Posted Sep 14, 2015
Authored by EgiX

Magento versions 1.9.2 and below suffer from an autoloaded file inclusion vulnerability.

tags | exploit, file inclusion
advisories | CVE-2015-6497
MD5 | 0d483734c211446d05ddbd10b09fa487

Magento 1.9.2 File Inclusion

Change Mirror Download
-------------------------------------------------------------------------------
Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability
-------------------------------------------------------------------------------


[-] Software Link:

http://magento.com/


[-] Affected Versions:

Version 1.9.2 and prior versions.


[-] Vulnerability Description:

The vulnerability is caused by the "catalogProductCreate" SOAP API implementation,
which is defined into the /app/code/core/Mage/Catalog/Model/Product/Api/V2.php script:

109. public function create($type, $set, $sku, $productData, $store = null)
110. {
111. if (!$type || !$set || !$sku) {
112. $this->_fault('data_invalid');
113. }
114.
115. $this->_checkProductTypeExists($type);
116. $this->_checkProductAttributeSet($set);
117.
118. /** @var $product Mage_Catalog_Model_Product */
119. $product = Mage::getModel('catalog/product');
120. $product->setStoreId($this->_getStoreId($store))
121. ->setAttributeSetId($set)
122. ->setTypeId($type)
123. ->setSku($sku);
124.
125. if (!property_exists($productData, 'stock_data')) {
126. //Set default stock_data if not exist in product data
127. $_stockData = array('use_config_manage_stock' => 0);
128. $product->setStockData($_stockData);
129. }

User input passed through the "productData" SOAP parameter is not properly validated before being
used in a call to the "property_exists()" function at line 125. This can be exploited by attackers
with valid API credentials to include and execute arbitrary PHP code (both from local or remote
resources) leveraging the Varien_Autoload::autoload() autoloading function. Successful exploitation
of this vulnerability requires the application running on PHP before version 5.4.24 or 5.5.8.


[-] Solution:

Update to version 1.9.2.1 or apply the SUPEE-6482 patch bundle.


[-] Disclosure Timeline:

[27/02/2015] - Vendor notified
[25/06/2015] - Vendor acknowledgement stating the issue will be fixed in the next release
[04/08/2015] - Version 1.9.2.1 released along with the patch for this vulnerability
[13/08/2015] - CVE number requested
[17/08/2015] - CVE number assigned
[11/09/2015] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2015-6497 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano of Minded Security.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2015-04


[-] Other References:

http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close