Critical Vulnerability in Mirasvit Full Page Cache Warmer Exposes Magento 2 Users

What changed

The Mirasvit Full Page Cache Warmer for Magento 2 has been found to contain a deserialization of untrusted data vulnerability. This flaw allows unauthenticated attackers to execute arbitrary code on the server by manipulating a crafted serialized PHP object.

The vulnerability arises from the unrestricted use of PHP's native unserialize() function, which can be exploited in conjunction with existing gadget chains in Magento and its dependencies.

Who is affected

The vulnerability impacts users of the Mirasvit Full Page Cache Warmer for Magento 2, specifically those running versions prior to 1.11.12.

Organizations utilizing this product may face significant security risks if they do not address this vulnerability promptly.

• Users of Mirasvit Full Page Cache Warmer for Magento 2 versions before 1.11.12.
• Magento merchants relying on the Full Page Cache Warmer for performance optimization.
• Developers and system administrators managing Magento installations that include this extension.
• E-commerce platforms using Magento 2 that integrate with third-party extensions.

What to do

It is crucial for affected users to upgrade to the latest version of Mirasvit Full Page Cache Warmer to mitigate this vulnerability. Regular updates and patch management should be a priority to safeguard against such risks.

Additionally, organizations should review their security policies and practices to ensure they are prepared to handle similar vulnerabilities in the future.

• Upgrade to Mirasvit Full Page Cache Warmer version 1.11.12 or later.
• Conduct a security audit of Magento installations to identify potential vulnerabilities.
• Implement best practices for secure coding and data handling in PHP applications.
• Educate staff on the risks associated with deserialization vulnerabilities and how to mitigate them.