CVE-2024-39397: Adobe Commerce RCE Vulnerability

CVE-2024-39397 Overview

CVE-2024-39397 is an Unrestricted Upload of File with Dangerous Type vulnerability affecting Adobe Commerce and Magento Open Source platforms. This vulnerability allows attackers to upload malicious files that can subsequently be executed on the server, resulting in arbitrary code execution. The flaw is particularly concerning for e-commerce environments as it can be exploited remotely without requiring user interaction, though the attack complexity is considered high. The vulnerability affects multiple versions across the 2.4.x branch of both Adobe Commerce and Magento Open Source.

Critical Impact

Remote attackers can achieve arbitrary code execution on affected Adobe Commerce and Magento servers by uploading malicious files, potentially leading to complete server compromise, data theft, and manipulation of e-commerce transactions.

Affected Products

• Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier
• Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier
• All patch versions in the 2.4.4.x, 2.4.5.x, 2.4.6.x, and 2.4.7.x branches prior to the security update

Discovery Timeline

• August 14, 2024 - CVE-2024-39397 published to NVD
• August 14, 2024 - Last updated in NVD database

Technical Details for CVE-2024-39397

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-known class of web application security flaws. The core issue lies in inadequate validation of uploaded files, allowing attackers to bypass file type restrictions and upload executable content to the server. Once the malicious file is uploaded and stored, the attacker can trigger its execution to gain control over the server.

The vulnerability is accessible over the network and requires no authentication or user interaction, making it particularly dangerous for internet-facing e-commerce installations. The scope of the vulnerability is changed, meaning successful exploitation can impact resources beyond the vulnerable component itself—potentially affecting the underlying operating system, database, and other connected systems. While attack complexity is high, requiring specific conditions to be met for successful exploitation, the potential impact to confidentiality, integrity, and availability is severe.

Root Cause

The root cause of CVE-2024-39397 is insufficient file type validation in Adobe Commerce and Magento Open Source file upload functionality. The application fails to properly verify and restrict the types of files that can be uploaded, allowing dangerous file types (such as PHP scripts or other server-side executable files) to be uploaded and stored in accessible locations on the server.

The vulnerability exists because the file upload mechanism does not adequately check file content, MIME types, or file extensions, or these checks can be bypassed through various techniques such as extension manipulation, null byte injection, or content-type spoofing.

Attack Vector

The attack vector for CVE-2024-39397 is network-based, allowing remote attackers to exploit the vulnerability without physical access to the target system. An attacker would typically follow these steps:

1. Identify an Adobe Commerce or Magento installation running a vulnerable version
2. Locate file upload functionality within the application (such as product image uploads, customer profile uploads, or administrative file management)
3. Craft a malicious file designed to execute server-side code (commonly a PHP web shell)
4. Upload the malicious file while bypassing any client-side or server-side file type restrictions
5. Access the uploaded file directly through the web server to trigger code execution
6. Leverage the achieved code execution to perform further malicious activities such as data exfiltration, privilege escalation, or establishing persistence

The vulnerability mechanism involves bypassing file type validation controls to upload executable content. For technical details on the specific upload vectors and bypass techniques, refer to the Adobe Security Advisory APSB24-61.

Detection Methods for CVE-2024-39397

Indicators of Compromise

• Presence of unexpected PHP files or other executable scripts in media or upload directories (pub/media/, var/upload/, media/)
• Suspicious file names with double extensions (e.g., image.php.jpg, file.phtml.png) in upload folders
• Unusual outbound network connections from the web server process
• Web server access logs showing direct requests to files in upload directories with executable extensions
• Unexpected modifications to core Magento/Commerce files or new files in non-standard locations

Detection Strategies

• Implement file integrity monitoring (FIM) to detect new or modified files in web-accessible directories
• Configure web application firewall (WAF) rules to detect file upload attacks and block requests containing suspicious file signatures
• Enable and monitor PHP error logs and web server logs for signs of web shell execution or path traversal attempts
• Deploy endpoint detection and response (EDR) solutions to monitor server behavior for post-exploitation activity

Monitoring Recommendations

• Regularly audit upload directories for files with executable extensions or suspicious content
• Monitor server resource utilization for anomalies that may indicate cryptomining or other unauthorized activities post-compromise
• Implement alerting on administrative account creation or privilege changes that could indicate attacker persistence
• Configure SentinelOne to monitor web server processes for anomalous child process spawning indicative of web shell execution

How to Mitigate CVE-2024-39397

Immediate Actions Required

• Update Adobe Commerce to version 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, or 2.4.4-p10 or later immediately
• Update Magento Open Source to the corresponding patched versions
• Audit all upload directories for suspicious files and remove any unauthorized content
• Review web server access logs for evidence of exploitation attempts
• Temporarily restrict file upload functionality if patching cannot be immediately performed

Patch Information

Adobe has released security updates addressing this vulnerability as documented in Adobe Security Advisory APSB24-61. Administrators should apply the latest security patches for their respective version branches:

• Adobe Commerce 2.4.7-p2 and later
• Adobe Commerce 2.4.6-p7 and later
• Adobe Commerce 2.4.5-p9 and later
• Adobe Commerce 2.4.4-p10 and later

The same patches apply to corresponding Magento Open Source versions. Organizations should follow Adobe's official update procedures and test patches in staging environments before production deployment.

Workarounds

• Implement strict file upload validation at the web server level using .htaccess rules or nginx configurations to deny execution of scripts in upload directories
• Configure the web server to serve uploaded files with Content-Disposition: attachment headers to prevent browser execution
• Use a Web Application Firewall (WAF) to inspect and block malicious file upload attempts
• Restrict access to file upload functionality to authenticated administrative users only until patching is complete
• Move upload directories outside the web root or configure the web server to prevent script execution in those locations

# Apache configuration to prevent script execution in upload directories
# Add to .htaccess in pub/media/ directory

<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|cgi|pl|asp|aspx|shtml|shtm|fcgi|fpl|jsp|htm|html|wml)$">
    Require all denied
</FilesMatch>

# Disable PHP execution
php_flag engine off

# For nginx, add to server block:
# location ~* ^/pub/media/.*\.(php|phtml|php3|php4|php5|php7)$ {
#     deny all;
# }