Vulnerability identifier: #VU40801

Vulnerability risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3458

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Magento Open Source
Web applications / E-Commerce systems

Vendor: Magento, Inc

Description

The vulnerability allows a remote #AU# to read and manipulate data.

The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Magento Open Source: 1.9.1.0, 1.14.1.0

---

External links
http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability
http://www.securityfocus.com/bid/74412
http://www.securitytracker.com/id/1032230

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.