TrojanOrder (CVE-2022-24086): how a checkout email became remote code execution
Kishore Adobe Commerce Certified Professional 7 min read
Covers events from 5 December 2022.
Template injection in Magento 2 order emails let attackers place a malicious order and run code on the server. It kicked off a wave of holiday-season compromises. The mechanism, the real-world campaigns, and the fix.
What TrojanOrder is
CVE-2022-24086 (TrojanOrder) is an unauthenticated template-injection flaw in Magento 2's order-email handling, rated CVSS 9.8 and patched in APSB22-12 (with a follow-up, CVE-2022-24087). An attacker places an order whose fields contain a malicious template directive; when Magento renders the transactional email, it executes the injected code on the server.
Root cause
Magento email templates support directives (for example, variable and block resolution). User-supplied order fields flowed into the template engine without sufficient sanitisation, so an attacker could inject a directive that resolves to a PHP object method call. It is a classic server-side template injection that reaches code execution through Magento's own rendering.
Why it was so widely abused
How attackers abuse it
- Submit an order with a crafted field (e.g. name/address) containing a template directive.
- Magento renders the order/invoice email, executing the directive server-side.
- Payloads typically write a web shell to a web-accessible path, then add a rogue admin for persistence.
Who got hit
Sansec tracked a surge of TrojanOrders heading into the 2022 holiday season and estimated a large share of Magento stores were vulnerable at the time. It remains on CISA's Known Exploited Vulnerabilities catalogue, and unpatched stores are still being hit years later.
How to check & fix
Affected: Magento Open Source / Adobe Commerce ≤ 2.4.3-p1 (and ≤ 2.3.7-p2) without the APSB22-12 patch. Apply the patch and rebuild. The patch is the fix; a full upgrade is optional.
# Apply the APSB22-12 patch for CVE-2022-24086 / -24087, then:
bin/magento setup:upgrade && bin/magento cache:flushIf you were unpatched during the wave
admin_user, cron_schedule, and CMS/layout tables, and rotate all
credentials and the encryption key.References & sources
Primary sources: advisories, vendor research and the CVE record. Verify against these rather than against us.