Magento / Adobe Commerce Checkout Template Injection

aka APSB22-12

Product: Adobe Adobe Commerce / Magento Open Source
CVE: CVE-2022-24086
Disclosed: 2022-02-13
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 2.3.3-p1 - 2.3.7-p2, 2.4.0 - 2.4.3-p1
Fixed: 2.3.7-p3, 2.4.3-p2 (emergency patches MDVA-43395 / MDVA-43443)

Summary

Adobe issued an out-of-band patch on a Sunday after this flaw was exploited in limited attacks against Magento stores. Improper input validation in the checkout flow allows template-directive injection that leads to code execution, enabling Magecart-style card skimming.

Root cause

Customer-supplied values in the checkout/order process (e.g. address or name fields) were later rendered through Magento's email template filter, which processes {{...}} directives. Crafted directives could invoke arbitrary methods and reach code execution; the first patch was incomplete and followed by CVE-2022-24087.

Impact

Unauthenticated RCE on Magento storefronts, typically used to inject payment skimmers.

Detection

Look for '{{' template directives (e.g. 'var this.getTemp', 'trans') in checkout/customer fields and order emails. nuclei template CVE-2022-24086.

Mitigation