search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
872 stars 176 forks source link

PRP: Request Adobe Commerce RCE(CVE-2024-20720) #462

Closed W0ngL1 closed 4 months ago

W0ngL1 commented 5 months ago

Hi there.

I would like to start implementing a plugin to detect Adobe Commerce RCE, CVE-2024-20720.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-20720 https://helpx.adobe.com/security/products/magento/apsb24-03.html

Description: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

Versions: 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier

Thanks.

tooryx commented 4 months ago

Hi @W0ngL1,

For now we are not interested in that vulnerability. As always, thank you for willing to contribute! Feel free to open new issues for other ideas that you might have.

~tooryx

W0ngL1 commented 4 months ago

Copy that.