Description
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Adobe Commerce | ≤ 2.4.4-p8 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Magento XXE Unserialize Arbitrary File Read
auxiliary/gather/magento_xxe_cve_2024_34102
-
CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)
exploit/linux/http/magento_xxe_to_glibc_buf_overflow
GitHub 24 repositories · most starred shown
-
Chocapikk/CVE-2024-34102 ★ 48 · Jun 28, 2024
CosmicSting (CVE-2024-34102)
-
bigb0x/CVE-2024-34102 ★ 31 · Jun 27, 2024
POC for CVE-2024-34102. A pre-authentication XML entity injection issue in Magento / Adobe Commerce.
-
th3gokul/CVE-2024-34102 ★ 14 · Jun 27, 2024
CVE-2024-34102: Unauthenticated Magento XXE
-
jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento ★ 8 · Jul 1, 2024
CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento (CVE-2024-34102)
-
EQSTLab/CVE-2024-34102 ★ 5 · Aug 13, 2024
Adobe Commerce XXE exploit
-
bughuntar/CVE-2024-34102 ★ 5 · Jul 13, 2024
Exploitation CVE-2024-34102
-
11whoami99/CVE-2024-34102 ★ 3 · Jun 28, 2024
POC for CVE-2024-34102 : Unauthenticated Magento XXE and bypassing WAF , You will get http connection on ur webhook
-
0x0d3ad/CVE-2024-34102 ★ 2 · Jun 30, 2024
CVE-2024-34102 (Magento XXE)
-
wubinworks/magento2-cosmic-sting-patch ★ 1 · Aug 8, 2024
An alternative solution(as a Magento 2 extension) to fix the XXE vulnerability CVE-2024-34102(aka Cosmic Sting). If you cannot upgrade Magento or cannot apply the official patch, try this one.
-
Phantom-IN/CVE-2024-34102 ★ 1 · Jul 14, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Adobe Commerce & Magento - CosmicSting http/cves/2024/CVE-2024-34102.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | magento/community-edition | 2.4.4 | — | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | >= 2.4.6-p1, < 2.4.6-p6 | 2.4.6-p6 | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | >= 2.4.5-p1, < 2.4.5-p8 | 2.4.5-p8 | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | < 2.4.4-p9 | 2.4.4-p9 | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | 2.4.5 | — | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | 2.4.6 | — | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | 2.4.7 | — | GHSA-m8cj-3v68-3cxj |
Advisories 2
- WID-SEC-2024-1361 Adobe Magento Open Source: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 17, 2024
- NCSC-2024-0255 Kwetsbaarheden verholpen in Adobe Commerce NCSC-NL (Netherlands) · Jul 1, 2024