Tenable Research discovers multiple vulnerabilities in the MAGMI Magento plugin that could lead to remote code execution on a vulnerable Magento site.

CVE-2020-5776, CVE-2020-5777: Multiple Vulnerabilities in the MAGMI Magento Mass Import Plugin

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default
    credentials in the event there is a database connection failure. A remote attacker can trigger this
    connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web
    server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at
    least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use
    default magmi:magmi basic authentication to remotely bypass authentication. (CVE-2020-5777)

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.24 suffer from a remote authentication bypass vulnerability by exhausting the database connections pool and then allowing an attacker to gain access to the administration interface. The attacker could leverage this vulnerability to perform remote code execution on the target application.

ID	Name	Product	Family	Severity
414845	SCA: security update for dweeves/magmi (GHSA-g475-pch5-6wvv)	Tenable Cloud Security	SCA Checks	critical
414845	SCA: security update for dweeves/magmi (GHSA-g475-pch5-6wvv)	Tenable Self-Hosted Container Security	SCA Checks	critical
112568	Magento Mass Importer < 0.7.24 Remote Authentication Bypass	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2020-5777

critical

Tenable Plugins

critical

critical

critical