Magento Mass Importer <0.7.24 - Remote Auth Bypass

criticalseverity

9.8CVSS score

23.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Magento Mass Importer (aka MAGMI) versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure.

Impact

An attacker can bypass authentication and gain unauthorized access to the Magento Mass Importer plugin.

Fix

Upgrade to version 0.7.24 or later to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /index.php/catalogsearch/advanced/result/?name=e
Positive when: contains "Too many connections" AND status 503

Run it with nuclei: nuclei -id CVE-2020-5777 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-5777

info:
  name: Magento Mass Importer  <0.7.24 - Remote Auth Bypass
  author: dwisiswant0
  severity: critical
  description: Magento Mass Importer (aka MAGMI) versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the Magento Mass Importer plugin.
  remediation: |
    Upgrade to version 0.7.24 or later to fix the authentication bypass vulnerability.
  reference:
    - https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
    - https://nvd.nist.gov/vuln/detail/CVE-2020-5777
    - https://www.tenable.com/security/research/tra-2020-51
    - https://github.com/404notf0und/CVE-Flow
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-5777
    cwe-id: CWE-287
    epss-score: 0.23303
    epss-percentile: 0.97795
    cpe: cpe:2.3:a:magmi_project:magmi:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: magmi_project
    product: magmi
    shodan-query:
      - http.component:"Magento"
      - http.component:"magento"
  tags: cve,cve2020,plugin,tenable,magmi,magento,auth,bypass,magmi_project,vuln

http:
  - raw:
      - |
        GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Too many connections"

      - type: status
        status:
          - 503

References

Use this check only on systems you are authorised to test. Where the data comes from