CVE-2024-34102
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
Description
CVE-2024-34102 is a critical XML External Entity (XXE) injection vulnerability in Adobe Commerce and Magento Open Source that enables unauthenticated remote code execution. Affecting Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, as well as Adobe Commerce Webhooks 1.2.0 through 1.5.0, this vulnerability allows an attacker to execute arbitrary code by sending crafted XML documents that reference external entities. With a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and an EPSS score of 0.94101 (99.9th percentile), it has been added to CISA's KEV catalog with a remediation deadline of August 7, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | commerce | 2.4.2; 2.4.3; 2.4.4; 2.4.5; 2.4.6; 2.4.7 |
| adobe | commerce webhooks | >= 1.2.0, < 1.5.0 |
| adobe | magento | 2.4.4; 2.4.5; 2.4.6; 2.4.7 |
References
- https://helpx.adobe.com/security/products/magento/apsb24-40.html(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102(Exploit, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102(Third Party Advisory, US Government Resource)
Weakness Type
XML External Entity (XXE) Injection
CVE-2024-34102, also known as "CosmicSting," is an Improper Restriction of XML External Entity Reference (XXE) vulnerability. XXE injection occurs when an application parses XML input that contains references to external entities without properly restricting or disabling this functionality. In Adobe Commerce and Magento, the application processes XML data from requests without disabling external entity resolution, allowing an attacker to craft XML payloads that reference external resources. Through XXE, the attacker can read local files, perform server-side request forgery (SSRF), and achieve remote code execution. The severity is amplified because the XXE endpoint is accessible without authentication, enabling any attacker who can reach the commerce platform to exploit it.
Impact Analysis
Complete E-Commerce Platform Compromise is the business consequence of CVE-2024-34102. Adobe Commerce (formerly Magento) powers a significant share of global e-commerce, processing payment transactions and storing customer data for thousands of online stores. Code execution on these platforms has severe financial and regulatory implications.
Confidentiality Impact is maximum (C:H). Exploitation provides access to all data stored by the commerce platform, including customer personal information (names, addresses, email addresses, phone numbers), order histories, payment processing configurations, administrator credentials, API keys for payment gateways and shipping providers, and potentially payment card data depending on the implementation's PCI compliance architecture.
Integrity Impact is maximum (I:H). An attacker with code execution can modify product listings, inject malicious JavaScript into storefront pages (web skimming/Magecart attacks), alter pricing, redirect payment flows, modify order data, and install persistent backdoors. E-commerce platforms are primary targets for web skimming attacks that capture payment card data entered by customers during checkout.
Availability Impact is maximum (A:H). The attacker can disable the commerce platform, corrupt the product database, or deploy ransomware, directly impacting the organization's revenue-generating operations. E-commerce downtime results in immediate financial losses.
Exploitation Context: The EPSS score of 0.94101 (99.9th percentile) confirms near-maximum exploitation probability. CISA lists the ransomware association as "Unknown," but e-commerce platforms are prime targets for both financial cybercrime (card skimming) and ransomware operations. The vulnerability has been nicknamed "CosmicSting" by security researchers due to its severity and widespread impact.
Exploit Maturity
CVE-2024-34102 is confirmed as actively exploited in the wild, as documented by its listing in CISA's KEV catalog with a remediation deadline of August 7, 2024. The EPSS score of 0.94101 (99.9th percentile) confirms near-universal exploitation probability.
CosmicSting Exploitation: Security researchers at Vicarius published a detailed technical analysis of the vulnerability, which they dubbed "CosmicSting." The analysis includes exploitation details demonstrating how the XXE vulnerability can be leveraged for full remote code execution without authentication.
Mass Exploitation of E-Commerce Platforms: Adobe Commerce and Magento are frequent targets for cybercriminals due to the financial value of the data they process. The unauthenticated nature of CVE-2024-34102 makes it particularly attractive for mass exploitation campaigns. Automated tools can scan the internet for Commerce/Magento installations and attempt exploitation at scale.
Magecart/Web Skimming Context: The Magecart threat group ecosystem has historically targeted Magento and Adobe Commerce platforms for web skimming attacks. CVE-2024-34102 provides a direct path to inject payment card skimming code into online stores, aligning with the primary objective of these threat actors.
Ransomware Association: CISA lists the ransomware status as "Unknown." However, the code execution capability and the high-value nature of e-commerce data make this vulnerability suitable for both ransomware deployment and data extortion attacks.
Remediation
-
Apply Adobe security patches immediately by following the guidance in Adobe Security Bulletin APSB24-40. Update Adobe Commerce to versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, or 2.4.4-p9 (or later). For Adobe Commerce Webhooks, update to version 1.5.0 or later. For Magento Open Source, apply the corresponding patches for your version branch.
-
Scan for web skimming indicators on all Commerce/Magento instances. Check for unauthorized JavaScript injections in payment pages, modified checkout templates, unexpected external resource references, and newly created or modified admin accounts. Use tools like Magento Security Scan or manual inspection of critical template files, particularly those involved in the checkout and payment flow.
-
Review server logs for XXE exploitation attempts by searching for malformed XML requests, external entity references in request bodies, unusual file read patterns, and unexpected outbound network connections that could indicate SSRF exploitation. Pay particular attention to requests targeting API endpoints that process XML input.
-
Rotate all credentials and API keys stored on or accessible from the Commerce platform. This includes administrator passwords, database credentials, payment gateway API keys, shipping provider credentials, email service credentials, and any other integration secrets. Assume that all credentials accessible to the application may have been compromised through the XXE file read capability.
-
Implement defense-in-depth measures including a web application firewall configured to detect and block XXE payloads, Content Security Policy headers to mitigate web skimming injections, file integrity monitoring on critical application files, and regular security scanning of the Commerce instance. Consider implementing runtime application self-protection (RASP) solutions that can detect and block XXE exploitation attempts at the application level.
Technical Details
CVE-2024-34102 is a critical XXE injection vulnerability in Adobe Commerce and Magento Open Source that enables unauthenticated remote code execution through crafted XML documents.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a base score of 9.8. The network attack vector (AV:N) enables remote exploitation through the commerce platform's web interface. Low attack complexity (AC:L) reflects the straightforward nature of XXE exploitation. No privileges (PR:N) or user interaction (UI:N) are required, making this fully unauthenticated. The scope is unchanged (S:U), and all impact metrics are maximum (C:H/I:H/A:H), reflecting complete platform compromise.
Vulnerability Mechanism: Adobe Commerce and Magento process XML input from certain API endpoints without properly restricting XML external entity resolution. An attacker crafts a malicious XML document containing external entity declarations that reference local files, internal network resources, or exploit PHP stream wrappers to achieve code execution. The XML parser resolves these entities during document processing, executing the attacker's payload without authentication checks.
XXE to RCE Escalation: The XXE vulnerability provides multiple attack vectors. Initially, it enables arbitrary file reading through external entity references pointing to local files (e.g., /etc/passwd or configuration files containing database credentials). Using PHP stream wrappers and filter chains, the attacker can escalate from file reading to remote code execution. The Vicarius "CosmicSting" analysis demonstrates the full exploitation chain from initial XXE to achieving arbitrary PHP code execution on the server.
Broad Product Impact: The vulnerability affects multiple Adobe Commerce versions (2.4.4 through 2.4.7), Adobe Commerce Webhooks (1.2.0 through 1.5.0), and corresponding Magento Open Source versions. This broad scope means both cloud-hosted Adobe Commerce instances and self-hosted Magento installations are affected, encompassing a large portion of the e-commerce platform ecosystem.
Frequently Asked Questions
What is CVE-2024-34102?
CVE-2024-34102, nicknamed "CosmicSting," is a critical XXE (XML External Entity) injection vulnerability in Adobe Commerce and Magento Open Source. It allows unauthenticated attackers to execute arbitrary code on the e-commerce platform by sending specially crafted XML documents, potentially leading to complete store compromise including access to customer data and payment information.
Which Adobe Commerce and Magento versions are affected?
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and all earlier versions are affected. Adobe Commerce Webhooks versions 1.2.0 through 1.5.0 and corresponding Magento Open Source versions are also vulnerable. Organizations should apply the patches from Adobe Security Bulletin APSB24-40 immediately.
Could my online store's customer data have been stolen?
If your store was running a vulnerable version and was accessible from the internet, it is possible. The vulnerability allows reading files on the server (including configuration files with database credentials) and executing code, which could grant full access to the store's database containing customer information, order data, and potentially payment details. Conduct a thorough forensic investigation and consider notifying affected customers per applicable breach notification requirements.
What is the relationship between CVE-2024-34102 and Magecart attacks?
Magecart refers to a collection of threat groups that inject web-skimming code into e-commerce platforms to steal payment card data during checkout. CVE-2024-34102 provides a direct path for these attackers to inject skimming code into Adobe Commerce and Magento stores without authentication. Any unpatched store is a potential target for Magecart-style attacks exploiting this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.