An XML external entity flaw in Adobe Commerce and Magento Open Source let attackers steal secret keys and, combined with another bug, run code. Patching alone was not enough.
Publicly disclosed: 11 June 2024
On 11 June 2024 Adobe fixed a critical vulnerability in Adobe Commerce and Magento Open Source, later nicknamed CosmicSting. Without logging in, an attacker could read files from the server, including the store's secret encryption key, and use it to create admin access tokens. Combined with a separate glibc flaw (CVE-2024-2961), it also allowed code execution. Thousands of stores were compromised and had card-skimming code added to checkout pages.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-34102 | Critical, CVSS 9.8 (XML external entity) | Adobe Commerce / Magento Open Source 2.4.7 and earlier | 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and later |
A stolen encryption key stays valid after the update. Adobe advised merchants who could have been affected to rotate the encryption key in addition to patching.
For online stores, also monitor checkout pages for unexpected JavaScript and use a payment provider's hosted payment page where possible.
Sources: Adobe bulletin APSB24-40, NVD CVE-2024-34102.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
