1## autogenerated on 2025-10-29 15:19:07
2name: crowdsecurity/vpatch-CVE-2022-24086
3description: 'Detects RCE in Adobe Commerce (Magento) via crafted JSON in checkout process (CVE-2022-24086)'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: contains
12          value: /rest/default/v1/guest-carts/
13      - zones:
14          - URI
15        transform:
16          - lowercase
17        match:
18          type: contains
19          value: /shipping-information
20      - zones:
21          - BODY_ARGS
22        variables:
23          - 'json.addressInformation.shipping_address.firstname'
24        transform:
25          - lowercase
26        match:
27          type: contains
28          value: 'addafterfiltercallback(system)'
29
30labels:
31  type: exploit
32  service: http
33  confidence: 3
34  spoofable: 0
35  behavior: 'http:exploit'
36  label: 'Adobe Commerce - RCE'
37  classification:
38    - cve.CVE-2022-24086
39    - attack.T1190
40    - cwe.CWE-20
41