More threat actors have been exploiting an already-patched critical security flaw in Magento 2, tracked as CVE-2022-24086, with Sansec researchers discovering three new attack variants leveraging the vulnerability to facilitate remote access trojan injections, reports BleepingComputer.
Attackers behind the first variant have been using a new customer account on the targeted platform with a template code, which allows the deployment of the Linux executable "223sam.jpg" that receives commands from a server in Bulgaria, according to a report from Sansec.
"This attack method defeats some of the security features of the Adobe Commerce Cloud platform, such as a read-only code base and restricted PHP execution under pub/media. The RAT has full access to the database and the running PHP processes, and can be injected on any of the nodes in a multi-server cluster environment," said researchers.
Moreover, PHP backdoor "health_check.php" is being injected in the second attack, while the third attack type involves the use of a backdoored "generated/code/Magento/Framework/App/FrontController/Interceptor.php" version.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.