Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21018

CVE-2021-21018: Magento OS Command Injection

9.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21018
GHSA ID
GHSA-rv48-v862-mp92
EPSS Score
0.91687%
CWE
CWE-78
Published
5/24/2022
Updated
1/10/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
magento/community-editioncomposer< 2.3.62.3.6
magento/community-editioncomposer>= 2.4.0, < 2.4.1-p12.4.1-p1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in the scheduled operation module (cron), which is handled by Magento's Cron module. The execute method in Schedule.php is responsible for running cron jobs. The advisory indicates OS command injection via cron configurations, implying user-supplied data (like command parameters) was used unsafely in system commands. This function likely constructs OS commands using admin-controlled input without proper sanitization, leading to arbitrary code execution when malicious commands are injected. The confidence is high because this aligns with CWE-78 patterns and Magento's cron execution flow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M***nto v*rsions *.*.* (*n* **rli*r), *.*.*-p* (*n* **rli*r) *n* *.*.* (*n* **rli*r) *r* vuln*r**l* to OS *omm*n* inj**tion vi* t** s****ul** op*r*tion mo*ul*. Su***ss*ul *xploit*tion *oul* l*** to *r*itr*ry *o** *x**ution *y *n *ut**nti**t** *tt**k*

Reasoning

T** vuln*r**ility *xists in t** s****ul** op*r*tion mo*ul* (*ron), w*i** is **n*l** *y M***nto's *ron mo*ul*. T** `*x**ut*` m*t*o* in `S****ul*.p*p` is r*sponsi*l* *or runnin* *ron jo*s. T** **visory in*i**t*s OS *omm*n* inj**tion vi* *ron *on*i*ur*t