Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
Impact
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases through 2.0.2 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-wqr6-wv6c-p8fx
View original version evidence (53 explicit versions)
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.3.7-p1Ecosystem versions | 2.3.7-p1 |
| From 2.4.2-p1 before 2.4.2-p2Ecosystem versions | 2.4.2-p2 |
Version evidence: OSV · GHSA-wqr6-wv6c-p8fx
View original version evidence (125 explicit versions)
Original source description
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.