Computer Security
[EN] securityvulns.ru no-pyccku


Related information

  Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

  [SECURITY] [DSA 3343-1] twig security update

  CVE-2015-6535: Stored XSS in YouTube Embed (WordPress plugin) allows admins to compromise super admins

  Jenkins 1.626 - Cross Site Request Forgery / Code Execution

  Dogma India dogmaindia CMS - Auth Bypass Vulnerability

From:Egidio Romano <research_(at)_karmainsecurity.com>
Date:26.10.2015
Subject:[KIS-2015-04] Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability



-------------------------------------------------------------------------------
Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability
-------------------------------------------------------------------------------


[-] Software Link:

http://magento.com/


[-] Affected Versions:

Version 1.9.2 and prior versions.


[-] Vulnerability Description:

The vulnerability is caused by the "catalogProductCreate" SOAP API implementation,
which is defined into the /app/code/core/Mage/Catalog/Model/Product/Api/V2.php script:

109. public function create($type, $set, $sku, $productData, $store = null)
110. {
111.    if (!$type || !$set || !$sku) {
112.        $this->_fault('data_invalid');
113.    }
114.
115.    $this->_checkProductTypeExists($type);
116.    $this->_checkProductAttributeSet($set);
117.
118.    /** @var $product Mage_Catalog_Model_Product */
119.    $product = Mage::getModel('catalog/product');
120.    $product->setStoreId($this->_getStoreId($store))
121.        ->setAttributeSetId($set)
122.        ->setTypeId($type)
123.        ->setSku($sku);
124.
125.    if (!property_exists($productData, 'stock_data')) {
126.        //Set default stock_data if not exist in product data
127.        $_stockData = array('use_config_manage_stock' => 0);
128.        $product->setStockData($_stockData);
129.    }

User input passed through the "productData" SOAP parameter is not properly validated before being
used in a call to the "property_exists()" function at line 125. This can be exploited by attackers
with valid API credentials to include and execute arbitrary PHP code (both from local or remote
resources) leveraging the Varien_Autoload::autoload() autoloading function. Successful exploitation
of this vulnerability requires the application running on PHP before version 5.4.24 or 5.5.8.


[-] Solution:

Update to version 1.9.2.1 or apply the SUPEE-6482 patch bundle.


[-] Disclosure Timeline:

[27/02/2015] - Vendor notified
[25/06/2015] - Vendor acknowledgement stating the issue will be fixed in the next release
[04/08/2015] - Version 1.9.2.1 released along with the patch for this vulnerability
[13/08/2015] - CVE number requested
[17/08/2015] - CVE number assigned
[11/09/2015] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2015-6497 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano of Minded Security.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2015-04


[-] Other References:

http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html


About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod