CosmicSting (CVE-2024-34102): critical vulnerability in Magento 2
CosmicSting is a critical XXE vulnerability in Magento 2 and Adobe Commerce. Which versions are affected, which updates fix it and what to do after updating.
On 11 June 2024, Adobe fixed a critical vulnerability in Magento 2 and Adobe Commerce with security bulletin APSB24-40. It is tracked as CVE-2024-34102, rated 9.8 (CVSS 3.1) and became known as CosmicSting.
What is CosmicSting?
It is an XXE (XML External Entity) vulnerability in the REST API. An attacker does not need an account in the shop. It allows reading files from the server, including app/etc/env.php with the database credentials and the shop's encryption key. Combined with other weaknesses, it can also lead to code execution on the server.
Which versions are affected?
- 2.4.7 (fixed in 2.4.7-p1)
- 2.4.6-p5 and earlier (fixed in 2.4.6-p6)
- 2.4.5-p7 and earlier (fixed in 2.4.5-p8)
- 2.4.4-p8 and earlier (fixed in 2.4.4-p9)
Shops on even older versions no longer receive updates from Adobe and are affected as well.
What if you cannot update right away?
On 27 June 2024 Adobe also released an isolated patch that fixes only this vulnerability. It can be applied even if a full version upgrade has to wait. As a stopgap for a few days, Sansec published a short code snippet that blocks the known attacks. It does not replace the patch.
After the update
If you patched several days after 11 June, assume the encryption key may have leaked. In that case the update alone is not enough:
- Generate a new encryption key and invalidate the old one
- Reset admin passwords, remove unknown admin accounts and API integrations
- Check CMS blocks and pages for injected JavaScript
I apply patches to the shops I look after and can also check shops I do not maintain. Write to me and tell me which version you run.
Sources: Adobe APSB24-40 · Sansec: CosmicSting. As of June 2024, patch notes added in July 2024.