TrojanOrders (CVE-2022-24086): The Checkout RCE Still Hitting Magento
TrojanOrders (CVE-2022-24086, and its twin CVE-2022-24087) is an improper input-validation flaw in Magento's checkout that lets an unauthenticated attacker inject a malicious template directive through an order — and execute code on your server. It was mass-exploited from late 2022 and still lands on stores that never applied the patch or run end-of-life Magento.
Not sure if your store is patched? Run a free MageArgus scan to check your version against the fixed patch levels.
- CVSS 9.8 — critical, unauthenticated RCE — Adobe APSB22-12 / NVD
- Tens of thousands of stores targeted in the weeks after disclosure — Sansec, 2022
- Fixed by the Feb 2022 patches (APSB22-12 / APSB22-13) — Adobe Security
How TrojanOrders works
The attacker places a real order but slips a Magento template directive into a field that gets rendered into an email or PDF — for example the customer name, address or VAT field. When Magento renders that template server-side, the directive is executed. Chained correctly it writes a PHP file (a webshell) into the store and gives the attacker remote code execution — hence the name: a trojan hidden inside an order.
Who is still vulnerable
Any Magento Open Source / Adobe Commerce that has not applied the APSB22-12 / APSB22-13 patches. In practice that means unpatched 2.4.3 and earlier, and every end-of-life 2.3.x store below 2.3.7-p3. Modern 2.4.4+ releases already include the fix. Check with bin/magento --version and compare against the current CVE list.
How to detect a TrojanOrders hit
Look for orders containing template syntax ({{, {{config path=, @php) in the name, address or company fields; new or modified PHP files under pub/media, pub/static or generated/; and admin users or integration tokens created around the order date. On disk, search for recently-changed .php files:
find pub/ app/ generated/ -name '*.php' -mtime -30 -type f
grep -rIl '{{config\|{{block\|@php\|base64_decode' app/design pub/media 2>/dev/nullThe fix
Apply the security patches and upgrade off any EOL branch:
composer require magento/product-community-edition=2.4.7-p1 --no-update
composer update --with-dependencies
bin/magento setup:upgrade && bin/magento cache:flushIf you cannot upgrade immediately, apply the isolated APSB22-12 / APSB22-13 hotfix via the Quality Patches Tool — see the patching guide. Because RCE means the attacker may already have a foothold, treat a vulnerable store as potentially breached: rotate the encryption key and admin passwords and hunt for webshells afterwards.
If you were already hit
Follow the full recovery plan: take checkout offline, remove any planted PHP files, restore modified core files from a clean release, rotate every secret, then re-scan. Deleting files without patching just invites re-infection.
Frequently asked questions
Is TrojanOrders the same as CosmicSting?
No. TrojanOrders (CVE-2022-24086) abuses checkout template rendering; CosmicSting (CVE-2024-34102) is an XXE flaw that leaks the encryption key. Both lead to remote code execution but through different entry points, and both are fixed by keeping Magento fully patched.
Can a WAF stop TrojanOrders?
A WAF can block some known payloads, but the reliable fix is the patch. Attackers vary the injected directive to evade signatures, so a WAF is a stopgap, not a substitute for updating Magento.