A catastrophic vulnerability was recently discovered in Adobe Commerce and Magento, but ecommerce websites operating these platforms seem largely uninterested in applying a patch.
As a result, “millions” of sites are open to attacks that could have devastating consequences, experts have warned.
As reported by BleepingComputer, cybersecurity researchers from Sansec discovered an improper restriction of XML external entity reference (‘XXE’) vulnerability, and dubbed it “CosmicSting”. It is now being tracked as CVE-2024-34102, and carries a severity score of 9.8 (critical).
Patch and mitigations
“CosmicSting (aka CVE-2024-34102) is the worst bug to hit Magento and Adobe Commerce stores in two years,” Sansec said in a security advisory. “In itself, it allows anyone to read private files (such as those with passwords). However, combined with the recent iconv bug in Linux, it turns into the security nightmare of remote code execution.”
Here are the product versions affected by CosmicSting:
- Adobe Commerce 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
- Adobe Commerce Extended Support 2.4.3-ext-7 and earlier, 2.4.2-ext-7 and earlier, 2.4.1-ext-7 and earlier, 2.4.0-ext-7 and earlier, 2.3.7-p4-ext-7 and earlier.
- Magento Open Source 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
- Adobe Commerce Webhooks Plugin versions 1.2.0 to 1.4.0
If your business is running any of the above, make sure to apply the patch – which was already made available – as soon as possible.
Sansec says that despite the vulnerability being made public more than a week ago, some 75% of Adobe Commerce and Magento users are yet to patch up. There is currently no evidence of in-the-wild abuse, and Adobe did not publish technical details so at to not give hackers any hints. However, Sansec says that the patch can be reverse-engineered and used to learn more about the bug.
Those who are unable to apply the patch immediately are advised to apply the mitigations found on this link.
