Skip to content
MAGEKWIKScanner
critical CVE-2022-24086 CVSS 9.8

TrojanOrder (CVE-2022-24086): how a checkout email became remote code execution

Magekwik Security 7 min read

CRITICAL CVES CVE-2022-24086 CVSS 9.8 scan.magekwik.com

Template injection in Magento 2 order emails let attackers place a malicious order and run code on the server. It kicked off a wave of holiday-season compromises. The mechanism, the real-world campaigns, and the fix.

What TrojanOrder is

CVE-2022-24086 (TrojanOrder) is an unauthenticated template-injection flaw in Magento 2's order-email handling, rated CVSS 9.8 and patched in APSB22-12 (with a follow-up, CVE-2022-24087). An attacker places an order whose fields contain a malicious template directive; when Magento renders the transactional email, it executes the injected code on the server.

Root cause

Magento email templates support directives (for example, variable and block resolution). User-supplied order fields flowed into the template engine without sufficient sanitisation, so an attacker could inject a directive that resolves to a PHP object method call — a classic server-side template injection that reaches code execution through Magento's own rendering.

Why it was so widely abused

The trigger is just placing an order — the most normal thing a storefront does. No login, no special endpoint. Attackers automated it at scale, which is how it earned the name "TrojanOrder": a poisoned order that carries a payload past the front door.

How attackers abuse it

  • Submit an order with a crafted field (e.g. name/address) containing a template directive.
  • Magento renders the order/invoice email, executing the directive server-side.
  • Payloads typically write a web shell to a web-accessible path, then add a rogue admin for persistence.

Who got hit

Sansec tracked a surge of TrojanOrders heading into the 2022 holiday season and estimated a large share of Magento stores were vulnerable at the time. It remains on CISA's Known Exploited Vulnerabilities catalog — unpatched stores are still being hit years later.

How to check & fix

Affected: Magento Open Source / Adobe Commerce ≤ 2.4.3-p1 (and ≤ 2.3.7-p2) without the APSB22-12 patch. Apply the patch and rebuild — a full upgrade is optional, the patch is the fix.

Patch and rebuild
# Apply the APSB22-12 patch for CVE-2022-24086 / -24087, then:
bin/magento setup:upgrade && bin/magento cache:flush

If you were unpatched during the wave

Assume compromise. Restore code from a known-good build (do not just delete the injected snippet), hunt for persistence in admin_user, cron_schedule, and CMS/layout tables, and rotate all credentials and the encryption key.

References & sources

Primary sources — advisories, vendor research, and the CVE record. Verify against these, not us.

  1. Adobe security bulletin APSB22-12
  2. Sansec — TrojanOrders research
  3. NVD — CVE-2022-24086
  4. CISA Known Exploited Vulnerabilities catalog

Related reading

← All security posts