Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover
Summary
A critical vulnerability in Magento's REST API, dubbed PolyShell, allows unauthenticated attackers to upload malicious executables disguised as images. This flaw enables attackers to achieve remote code execution and take over user accounts.
IFF Assessment
FOE
This vulnerability allows attackers to gain unauthorized access and control over Magento systems, posing a significant threat to businesses and their customers.
Severity
9.8
Critical
(AI Estimated)
Defender Context
This critical vulnerability in Magento's REST API requires immediate attention from defenders managing e-commerce platforms. Organizations should prioritize patching this flaw and implement strict input validation and file type checks for uploads, especially through APIs, to prevent similar attacks.