{"id":1573,"date":"2026-06-07T09:31:21","date_gmt":"2026-06-07T02:31:21","guid":{"rendered":"https:\/\/vncybers.vn\/cisa-canh-bao-lo-hong-magento-cve-2026-45247-dang-bi-khai-thac-thuc-te\/"},"modified":"2026-06-07T09:32:03","modified_gmt":"2026-06-07T02:32:03","slug":"cisa-canh-bao-lo-hong-magento-cve-2026-45247-dang-bi-khai-thac-thuc-te","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/cisa-canh-bao-lo-hong-magento-cve-2026-45247-dang-bi-khai-thac-thuc-te\/","title":{"rendered":"CISA c\u1ea3nh b\u00e1o l\u1ed7 h\u1ed5ng Magento CVE-2026-45247 \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf"},"content":{"rendered":"

C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng M\u1ef9 (CISA) \u0111\u00e3 \u0111\u01b0a CVE-2026-45247 v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities sau khi ghi nh\u1eadn l\u1ed7 h\u1ed5ng trong Mirasvit Full Page Cache Warmer, m\u1ed9t ti\u1ec7n \u00edch t\u0103ng t\u1ed1c b\u1ed9 nh\u1edb \u0111\u1ec7m cho Magento 2 v\u00e0 Adobe Commerce, \u0111ang b\u1ecb khai th\u00e1c ngo\u00e0i th\u1ef1c t\u1ebf. \u0110\u00e2y l\u00e0 nh\u00f3m r\u1ee7i ro \u0111\u00e1ng ch\u00fa \u00fd v\u1edbi c\u00e1c website th\u01b0\u01a1ng m\u1ea1i \u0111i\u1ec7n t\u1eed v\u00ec \u0111i\u1ec3m y\u1ebfu n\u1eb1m ngay tr\u00ean l\u1edbp storefront, n\u01a1i lu\u00f4n m\u1edf ra Internet.<\/p>\n

\"CISA<\/p>\n

Where is the gap?<\/h2>\n

CVE-2026-45247 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn Mirasvit Full Page Cache Warmer tr\u01b0\u1edbc phi\u00ean b\u1ea3n 1.11.12. Theo m\u00f4 t\u1ea3 k\u1ef9 thu\u1eadt t\u1eeb NVD v\u00e0 c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u, l\u1ed7i b\u1eaft ngu\u1ed3n t\u1eeb vi\u1ec7c x\u1eed l\u00fd d\u1eef li\u1ec7u kh\u00f4ng tin c\u1eady trong cookie CacheWarmer. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 g\u1eedi m\u1ed9t \u0111\u1ed1i t\u01b0\u1ee3ng PHP \u0111\u00e3 \u0111\u01b0\u1ee3c serialize qua cookie n\u00e0y, t\u1eeb \u0111\u00f3 k\u00edch ho\u1ea1t chu\u1ed7i gadget c\u00f3 s\u1eb5n trong Magento ho\u1eb7c th\u01b0 vi\u1ec7n ph\u1ee5 thu\u1ed9c \u0111\u1ec3 th\u1ef1c thi m\u00e3 t\u1eeb xa tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n

\u0110i\u1ec3m nguy hi\u1ec3m l\u00e0 cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng y\u00eau c\u1ea7u \u0111\u0103ng nh\u1eadp, kh\u00f4ng c\u1ea7n quy\u1ec1n qu\u1ea3n tr\u1ecb v\u00e0 c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t qua request storefront th\u00f4ng th\u01b0\u1eddng. V\u1edbi \u0111i\u1ec3m CVSS 9.8, \u0111\u00e2y kh\u00f4ng c\u00f2n l\u00e0 l\u1ed7i hi\u1ec7u n\u0103ng c\u1ee7a m\u1ed9t extension ph\u1ee5 tr\u1ee3 m\u00e0 l\u00e0 r\u1ee7i ro chi\u1ebfm quy\u1ec1n m\u00e1y ch\u1ee7 \u0111\u1ed1i v\u1edbi c\u00e1c c\u1eeda h\u00e0ng Magento ch\u01b0a v\u00e1.<\/p>\n

V\u00ec sao s\u1ef1 c\u1ed1 n\u00e0y nghi\u00eam tr\u1ecdng?<\/h2>\n

Magento v\u00e0 Adobe Commerce th\u01b0\u1eddng x\u1eed l\u00fd d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng, \u0111\u01a1n h\u00e0ng, m\u00e3 gi\u1ea3m gi\u00e1, t\u00edch h\u1ee3p thanh to\u00e1n, t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb v\u00e0 nhi\u1ec1u k\u1ebft n\u1ed1i n\u1ed9i b\u1ed9 kh\u00e1c. N\u1ebfu m\u00e1y ch\u1ee7 b\u1ecb th\u1ef1c thi m\u00e3 t\u1eeb xa, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 c\u00e0i web shell, \u0111\u00e1nh c\u1eafp th\u00f4ng tin c\u1ea5u h\u00ecnh, ch\u00e8n m\u00e3 \u0111\u1ed9c v\u00e0o trang thanh to\u00e1n, ho\u1eb7c d\u00f9ng h\u1ea1 t\u1ea7ng th\u01b0\u01a1ng m\u1ea1i \u0111i\u1ec7n t\u1eed l\u00e0m b\u00e0n \u0111\u1ea1p cho c\u00e1c chi\u1ebfn d\u1ecbch ti\u1ebfp theo.<\/p>\n

The Hacker News d\u1eabn th\u00f4ng tin t\u1eeb Sansec cho bi\u1ebft c\u00f3 kho\u1ea3ng 6.000 c\u1eeda h\u00e0ng \u0111ang ch\u1ea1y c\u00e1c extension Mirasvit, nh\u01b0ng con s\u1ed1 th\u1ef1c t\u1ebf c\u00f3 th\u1ec3 cao h\u01a1n v\u00ec nhi\u1ec1u website \u1ea9n sau CDN nh\u01b0 Cloudflare. Imperva c\u0169ng ghi nh\u1eadn ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c b\u1eb1ng payload PHP object \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a base64, trong \u0111\u00f3 m\u1ed9t s\u1ed1 payload d\u00f9ng l\u1ec7nh ki\u1ec3m tra \u0111\u1ec3 x\u00e1c nh\u1eadn kh\u1ea3 n\u0103ng th\u1ef1c thi m\u00e3 tr\u00ean h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau.<\/p>\n

D\u1ea5u hi\u1ec7u c\u1ea7n ki\u1ec3m tra ngay<\/h2>\n

Qu\u1ea3n tr\u1ecb vi\u00ean Magento n\u00ean ki\u1ec3m tra log web server, WAF v\u00e0 CDN \u0111\u1ec3 t\u00ecm request c\u00f3 cookie CacheWarmer b\u1ea5t th\u01b0\u1eddng. Sansec khuy\u1ebfn ngh\u1ecb ch\u00fa \u00fd m\u1eabu CacheWarmer theo sau b\u1edfi chu\u1ed7i base64 b\u1eaft \u0111\u1ea7u b\u1eb1ng c\u00e1c ti\u1ec1n t\u1ed1 th\u01b0\u1eddng g\u1eb7p c\u1ee7a \u0111\u1ed1i t\u01b0\u1ee3ng PHP \u0111\u00e3 serialize nh\u01b0 Tz, Qz ho\u1eb7c YT. \u0110\u00e2y l\u00e0 ch\u1ec9 b\u00e1o m\u1ea1nh cho n\u1ed7 l\u1ef1c khai th\u00e1c PHP object injection.<\/p>\n

Ngo\u00e0i log HTTP, \u0111\u1ed9i v\u1eadn h\u00e0nh c\u0169ng c\u1ea7n r\u00e0 so\u00e1t file m\u1edbi xu\u1ea5t hi\u1ec7n trong webroot, cron l\u1ea1, t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb m\u1edbi, thay \u0111\u1ed5i b\u1ea5t th\u01b0\u1eddng trong m\u00e3 giao di\u1ec7n thanh to\u00e1n v\u00e0 k\u1ebft n\u1ed1i outbound kh\u00f4ng r\u00f5 ngu\u1ed3n g\u1ed1c. V\u1edbi website th\u01b0\u01a1ng m\u1ea1i \u0111i\u1ec7n t\u1eed, vi\u1ec7c ch\u1ec9 c\u1eadp nh\u1eadt extension m\u00e0 kh\u00f4ng ki\u1ec3m tra d\u1ea5u v\u1ebft x\u00e2m nh\u1eadp c\u00f3 th\u1ec3 b\u1ecf s\u00f3t web shell \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00e0i tr\u01b0\u1edbc \u0111\u00f3.<\/p>\n

Khuy\u1ebfn ngh\u1ecb cho doanh nghi\u1ec7p<\/h2>\n

Bi\u1ec7n ph\u00e1p \u01b0u ti\u00ean l\u00e0 c\u1eadp nh\u1eadt Mirasvit Full Page Cache Warmer l\u00ean phi\u00ean b\u1ea3n 1.11.12 ho\u1eb7c m\u1edbi h\u01a1n. N\u1ebfu ch\u01b0a th\u1ec3 v\u00e1 ngay, doanh nghi\u1ec7p n\u00ean t\u1ea1m th\u1eddi v\u00f4 hi\u1ec7u h\u00f3a module li\u00ean quan, ch\u1eb7n c\u00e1c request c\u00f3 m\u1eabu cookie \u0111\u00e1ng ng\u1edd \u1edf WAF\/CDN, sao l\u01b0u log \u0111\u1ec3 ph\u1ee5c v\u1ee5 \u0111i\u1ec1u tra v\u00e0 r\u00e0 so\u00e1t to\u00e0n b\u1ed9 g\u00f3i Mirasvit \u0111\u00e3 c\u00e0i qua Composer.<\/p>\n

C\u00e1c \u0111\u1ed9i b\u1ea3o m\u1eadt c\u0169ng n\u00ean \u0111\u01b0a CVE-2026-45247 v\u00e0o danh s\u00e1ch ki\u1ec3m tra kh\u1ea9n c\u1ea5p cho nh\u1eefng website Magento \u0111ang v\u1eadn h\u00e0nh, \u0111\u1eb7c bi\u1ec7t l\u00e0 h\u1ec7 th\u1ed1ng c\u00f3 t\u00edch h\u1ee3p thanh to\u00e1n, ch\u01b0\u01a1ng tr\u00ecnh kh\u00e1ch h\u00e0ng th\u00e2n thi\u1ebft ho\u1eb7c \u0111\u1ed3ng b\u1ed9 d\u1eef li\u1ec7u v\u1edbi ERP\/CRM. V\u1edbi l\u1ed7 h\u1ed5ng \u0111\u00e3 v\u00e0o CISA KEV, th\u1eddi gian ph\u1ea3n \u1ee9ng n\u00ean \u0111\u01b0\u1ee3c t\u00ednh b\u1eb1ng gi\u1edd, kh\u00f4ng ph\u1ea3i b\u1eb1ng tu\u1ea7n.<\/p>\n

Key Takeaways<\/h2>\n

S\u1ef1 c\u1ed1 Mirasvit cho th\u1ea5y extension t\u1ed1i \u01b0u hi\u1ec7u n\u0103ng c\u0169ng c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh c\u1eeda ng\u00f5 t\u1ea5n c\u00f4ng nghi\u00eam tr\u1ecdng n\u1ebfu x\u1eed l\u00fd d\u1eef li\u1ec7u t\u1eeb client kh\u00f4ng an to\u00e0n. C\u00e1c website th\u01b0\u01a1ng m\u1ea1i \u0111i\u1ec7n t\u1eed c\u1ea7n qu\u1ea3n l\u00fd extension nh\u01b0 m\u1ed9t ph\u1ea7n c\u1ee7a b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng ch\u00ednh: theo d\u00f5i phi\u00ean b\u1ea3n, ki\u1ec3m tra ngu\u1ed3n cung \u1ee9ng, \u0111\u1eb7t c\u1ea3nh b\u00e1o log v\u00e0 duy tr\u00ec quy tr\u00ecnh v\u00e1 nhanh cho m\u1ecdi th\u00e0nh ph\u1ea7n n\u1eb1m tr\u00ean \u0111\u01b0\u1eddng request c\u00f4ng khai.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News, CISA, NVD, Sansec v\u00e0 Imperva<\/em><\/p>","protected":false},"excerpt":{"rendered":"

C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng M\u1ef9 (CISA) \u0111\u00e3 \u0111\u01b0a CVE-2026-45247 v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities sau khi ghi nh\u1eadn l\u1ed7 h\u1ed5ng trong Mirasvit Full Page Cache Warmer, m\u1ed9t ti\u1ec7n \u00edch t\u0103ng t\u1ed1c b\u1ed9 nh\u1edb \u0111\u1ec7m cho Magento 2 v\u00e0 Adobe Commerce, \u0111ang b\u1ecb khai th\u00e1c ngo\u00e0i th\u1ef1c t\u1ebf. \u0110\u00e2y […]<\/p>\n","protected":false},"author":2,"featured_media":1572,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[166,167,163,170,165,164,169,168],"class_list":["post-1573","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-adobe-commerce","tag-cisa-kev","tag-cve-2026-45247","tag-e-commerce-security","tag-magento","tag-mirasvit","tag-php-object-injection","tag-remote-code-execution"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1573"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1573\/revisions"}],"predecessor-version":[{"id":1574,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1573\/revisions\/1574"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1572"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}