Critical Vulnerability in Mirasvit Full Page Cache Warmer Allows Remote Code Execution

What changed

A vulnerability has been discovered in Mirasvit Full Page Cache Warmer for Magento 2, specifically in versions prior to 1.11.12. This flaw involves the deserialization of untrusted data, which can be exploited by attackers to execute arbitrary code on the server.

The issue arises from an unrestricted call to PHP's native unserialize() function, enabling attackers to inject crafted serialized PHP objects via the CacheWarmer cookie.

Who is affected

The vulnerability impacts multiple stakeholders, particularly those using the affected version of the Mirasvit Full Page Cache Warmer.

Organizations utilizing Magento 2 with the Mirasvit extension are at risk of exploitation if they have not updated to version 1.11.12 or later.

• Mirasvit Full Page Cache Warmer for Magento 2 (versions before 1.11.12)
• Magento 2 users employing Mirasvit extensions
• E-commerce platforms relying on Magento for their operations
• Developers and system administrators managing Magento installations

What to do

It is crucial for affected users to take immediate action to mitigate risks associated with this vulnerability. Updating to the latest version of the Mirasvit Full Page Cache Warmer is strongly recommended.

In addition, organizations should review their security protocols and consider implementing additional measures to protect against potential exploitation.

• Upgrade to Mirasvit Full Page Cache Warmer version 1.11.12 or later.
• Conduct a security assessment of your Magento 2 environment.
• Monitor for any unusual activity that may indicate exploitation attempts.
• Implement best practices for securing PHP applications, including limiting the use of unserialize() where possible.