Sansec

Unauthenticated attackers can inject malicious template syntax because unsanitized user-supplied input is passed to the Smarty template engine, a tool used to generate dynamic web content. This allows for the retrieval of sensitive server-side information, including encryption keys and database credentials. In versions 5.4.0 through 5.7.1, attackers can use registered Smarty modifiers, specifically `unserialize()` and `file get contents()`, to write a webshell to the web root and execute arbitrary commands with the privileges of the web server user.

An unauthenticated arbitrary file upload issue allows attackers to write files of any type or name to the store's media directory. This occurs because the upload endpoint lacks authentication, session validation, and cart context. This can lead to remote code execution if the media directory permits PHP execution. Additionally, it enables malware hosting, stored cross-site scripting (XSS)—where malicious scripts are permanently stored on the server—via HTML or SVG uploads, and path traversal to write files outside the intended directory.

A PHP object injection issue exists due to the unrestricted use of the native `unserialize()` function. Unauthenticated attackers can achieve remote code execution by providing a crafted serialized PHP object within the `CacheWarmer` cookie, leveraging gadget chains available in Magento and its dependencies. This flaw has been actively exploited in the wild to deploy web shells and create administrative accounts, affecting thousands of Adobe Commerce storefronts.