Listen to this Post
The vulnerability exists in the processing of jobs from the `algoliasearch_queue` database table. Data from the `data` column of this table is passed to the PHP `unserialize()` function without proper validation. An attacker who gains the ability to write a malicious serialized object (e.g., containing a gadget chain for PHP object injection) into this `data` field can achieve arbitrary PHP code execution. This occurs when the Algolia indexing queue cron job processes the poisoned queue record, triggering the deserialization of the attacker-controlled object and leading to remote command execution on the Magento server.
Platform: Magento 2 Extension
Version: < 3.17.2, <3.16.2
Vulnerability: Insecure Deserialization
Severity: Critical
date: Not Specified
Prediction: Patched 2024-Q1
What Undercode Say:
Check for suspicious queue entries mysql -u [bash] -p[bash] [bash] -e "SELECT FROM algoliasearch_queue WHERE data LIKE '%O:8:\"stdClass\"%';" Disable the Algolia queue via config (temporary) bin/magento config:set algoliasearch_queue/active 0
How Exploit:
- Attacker writes malicious serialized PHP object to `algoliasearch_queue.data` column.
2. Example payload: `O:20:”Vendor\Module\Malicious”:1:{s:6:”command”;s:10:”touch /tmp/pwned”;}`
- Cron job `algoliasearch_queue_runner` executes and deserializes the payload.
4. Gadget chain triggers, executing embedded system commands.
Protection from this CVE:
- Upgrade immediately to version 3.17.2+ or 3.16.2+.
- Disable the Algolia indexing queue feature.
- Implement strict database access controls.
- Audit `algoliasearch_queue` table entries regularly.
Impact:
Arbitrary PHP code execution leading to full server compromise, data theft, and site defacement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
