CVE-2026-53787 Scanner
CVE-2026-53787 Scanner - Unauthenticated Arbitrary File Upload vulnerability in Magento 2 Amasty Order Attributes
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
20 days 15 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
Amasty Order Attributes is a popular extension for Magento 2, extensively used by e-commerce businesses to add custom fields to checkout pages, enhancing order management capabilities. This extension is widely implemented by Magento users who require additional attribute fields for customer orders. Developed by Amasty, a well-known provider of Magento extensions, it integrates seamlessly with Magento's architecture to offer flexible customization options. The software is often utilized in various online retail stores aiming to improve customer interaction and data collection during the purchase process. Its primary purpose is to provide store administrators with enhanced tools for capturing and managing order-related data that exceed default Magento functionalities.
The vulnerability exists as an unauthenticated arbitrary file upload flaw within the Amasty Order Attributes extension for Magento 2 versions earlier than 4.0.0. This security issue allows unauthenticated attackers to upload malicious files due to insufficient validation at the file upload endpoint. The flaw stems from a lack of proper authentication and file validation mechanisms which can result in serious security risks. Attackers might gain the ability to execute arbitrary code or host malware by exploiting this vulnerability. Such weaknesses often lead to compromise of server integrity and could be leveraged for further attacks if unpatched.
Technical details of the vulnerability indicate a failure in securing the upload endpoint where files are handled. Attackers can directly send crafted requests to the vulnerable '/rest/V1/amasty_orderattr/uploadFile' endpoint without prior authentication. Parameters like 'fileContent' in the JSON payload are exploited to include base64 encoded data and filename with unsupported formats, potentially including PHP files. Successfully uploading a file through this vulnerability requires the return of a 200 status code, confirming the file exists on the server. Vulnerable endpoints, if left unprotected, can thus be manipulated to upload executable or harmful files, leading to potential exploitation.
Exploiting this vulnerability can have severe consequences including unauthorized control over the server environment. Attackers may execute harmful code and gain persistent access, unleashing malware or exploiting additional vulnerabilities. The ability to upload executable files can lead to remote code execution (RCE), data breaches, and the alteration or deletion of crucial system files. This exposure significantly elevates the attack vector of affected systems, posing a critical threat to data confidentiality and system integrity.
REFERENCES
