Magento Sites Vulnerable to RCE Stemming From Magmi Plugin Flaws

Researchers have disclosed two flaws that could enable remote code execution attacks on the Magento Mass Import (Magmi) plugin, an open source database client that imports data into Magento.

Magmi is a Magento database client written in PHP, which is used to perform raw bulk operations on the models of an online store. A patch has only been published for one of the two flaws (CVE-2020-5777), in Magmi version 0.7.24, Sunday. At the time of disclosure, however, there was still no patch available for two second flaw (CVE-2020-5776), said researchers.

Satnam Narang, staff research engineer at Tenable, told Threatpost that researchers can’t definitively say how many Magento sites are vulnerable – however, they were able to identify at least 1,500 websites indexed through search engines that use the Magmi plugin (and it’s likely there are more).

“To reduce your risk in the meantime, we recommend disabling or uninstalling the plugin altogether until a patch is available, as well as refraining from active web browsing while authenticated to Magmi,” said researchers with Tenable in a Tuesday post.

Researchers on Tuesday also released proof-of-concept (PoC) exploit code on GitHub for both of the flaws.

The Flaws

The unpatched flaw, CVE-2020-5776, is a cross-site request forgery (CSRF) vulnerability affecting Magmi up to version 0.7.24.  While this flaw has a CVSSv2 score of 6.8 out of 10 (making it medium severity), vulnerability database VulDB  classified it as critical.

The flaw, which affects an unknown functionality of a specific file (/index.php/newsletter/subscriber/new/), exists because the GET and POST endpoints for Magmi don’t implement CSRF protection – meaning an attacker could exploit the flaw vulnerability to perform a CSRF attack. CSRF occurs when a malicious website sends a request to a web application that a victim is already authenticated against. This way an attacker can access the functionality in a target web application via the victim’s already authenticated browser.

In this specific attack, threat actors could trick a Magento Administrator into clicking on a link while they are authenticated to Magmi. The attacker could then hijack the administrator’s sessions, allowing them to execute arbitrary code on the server where Magmi is hosted, researchers said.

The second, now patched flaw, CVE-2020-5777, is an authentication bypass flaw in Magmi for Magento version 0.7.23 and below. This flaw also has a CVSSv2 score of 6.8 out of 10, making it medium severity, researchers told Threatpost.

Magmi’s authentication process uses HTTP Basic authentication and checks the username and password against the Magento database’s admin_user table. However, if the connection to the Magento database fails, Magmi will accept default credentials, which are magmi:magmi.

“As a consequence, an attacker could force the database connection to fail due to a database denial of service (DB-DoS) attack, then authenticate to Magmi using the default credentials,” said researchers. “The impact of this attack is remote code execution (RCE) on the server where Magmi is hosted.”

Researchers successfully performed a Magento DB-DoS attack when the maximum number of concurrent MySQL connections was greater than the maximum number of concurrent Apache HTTP connections.

“By sending a large number of concurrent connection requests that exceed the MySQL connections limit, but not the maximum Apache HTTP connection limit, attackers could temporarily block access to the Magento database and simultaneously make an authenticated request to Magmi using the default credentials,” said researchers.

Disclosure

Researchers said that they reached out to the developer of the Magmi plugin on June 3. After follow-up communications on June 17 and July 6, they received acknowledgement on July 6 that the identified issues were in the process of being fixed.

“We have since sent requests for updates and have not received any. However, the developers released a new version of the plugin on August 30 to address one of the two vulnerabilities (CVE-2020-5777),” they said.

“This release fixes a security issue due to a potential exploit on Magmi default authentication,” according to Magmi’s description of its latest version, 7.24. Threatpost has reached out to the developers of Magmi for further comment.

It’s not the first time that the Magento open-source e-commerce platform has faced security issues due to third-party plugins (as well as flaws in Magento itself). An FBI flash security alert that became public in May 2020 regarding in-the-wild exploitation of CVE-2017-7391, a cross-site scripting vulnerability in Magmi that was used to target vulnerable Magento sites. In 2018, attackers used a few IP addresses to scan for vulnerable versions of Magmi.

On Wed Sept. 16 @ 2 PM ET: Learn the secrets to running a successful Bug Bounty Program. Register today for this FREE Threatpost webinar “Five Essentials for Running a Successful Bug Bounty Program“. Hear from top Bug Bounty Program experts how to juggle public versus private programs and how to navigate the tricky terrain of managing Bug Hunters, disclosure policies and budgets. Join us Wednesday Sept. 16, 2-3 PM ET for this LIVE webinar.