Actively exploited · Published Jun 13, 2024 · Assigned by adobe
CVE-2024-34102XXE can expose crypt key and other secrets granting full admin access
Critical 9.8 Exploited
In plain English
A critical-severity XML external entity in Adobe Commerce from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on July 17, 2024). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 7, 2024.
Official description
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | magento/community-edition | no fix listed | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | 2.4.6-p6 | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | 2.4.5-p8 | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | 2.4.4-p9 | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | no fix listed | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | no fix listed | GHSA-m8cj-3v68-3cxj |
| Packagist | magento/community-edition | no fix listed | GHSA-m8cj-3v68-3cxj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Adobe Commerce | 0 – through 2.4.4-p8 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://helpx.adobe.com/security/products/magento/apsb24-40.html vendor-advisory
- https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102 government-resource