It is no secret that cybersecurity is of utmost importance for any business. Apart from keeping up to date with current cybersecurity measures, one should also stay informed of current issues being faced. One of those issues is the recent Magneto 2 RCE Bug attack.
Here is what we know
The Magento 2 RCE bug is actively attacked, according to Adobe. On Sunday, Adobe released an emergency remedy, and eCommerce websites should update as soon as possible to avoid Magecart card-skimming attacks and other issues.
How are you affected by the Magneto 2 RCE bug?
The security flaw (CVE-2022-24086) is a serious one, as it allows for pre-authentication RCE due to incorrect input validation. On the CVSS vulnerability-severity scale, it receives a 9.8 out of ten, however, there is one mitigating factor: an attacker would need administrator rights to succeed.
Adobe’s Magento platform had a severe security flaw, according to information disclosed in a recent report. Magento is a well-known open-source e-commerce platform that makes running an online store easier. Because of its widespread use, any flaw in the platform has a direct impact on thousands of online stores throughout the world. The Adobe Commerce and Magento Open Source platforms both had a significant code execution flaw, according to the alert. The internet behemoth even admits to actively exploiting the issue that targeted specific online retailers.
Prevention methods
For online merchants, upgrading is critical. The Magecart group is well-known for targeting unpatched versions of Magento in particular, looking for a way to install credit-card skimmers on eCommerce checkout pages.
The threat actor, which is actually a collection of many card-harvesting subgroups, is constantly improving its skimmers in order to make them more successful and efficient at evasion. For example, in November, it introduced an extra browser process that checks a user’s system using the WebGL JavaScript API to guarantee it isn’t operating on a virtual machine, avoiding researcher detection. In January, a skimmer was planted on Segway’s website using a favicon that typical security systems wouldn’t detect.
For the time being, Adobe has described the attacks as “very limited.” However, card-skimmer activity is on the rise, and website owners’ updates appear to be scarce.
Final thought
This is an “emergency remedy” for Adobe Commerce, which comes a week after the company’s Patch Tuesday updates for several products. As a result, users of Adobe Photoshop, Illustrator, After Effects, Adobe Premiere Rush, and Creative Cloud Desktop should check for the latest updates on their systems.
