Ecommerce sites across the world could be at risk from this dangerous security flaw, so patch now

News
By
published

Adobe Commerce and Magento platforms thought to be affected

Digital commerce.
(Image credit: Adobe Stock)

A catastrophic vulnerability was recently discovered in Adobe Commerce and Magento, but some of the best ecommerce platforms operating these tools seem largely uninterested in applying a patch. 

As a result, “millions” of sites are open to attacks that could have devastating consequences, experts have warned.

As reported by BleepingComputer, cybersecurity researchers from Sansec discovered an improper restriction of XML external entity reference ('XXE') vulnerability, and dubbed it “CosmicSting”. It is now being tracked as CVE-2024-34102, and carries a severity score of 9.8 (critical).

Patch and mitigations

"CosmicSting (aka CVE-2024-34102) is the worst bug to hit Magento and Adobe Commerce stores in two years," Sansec said in a security advisory. "In itself, it allows anyone to read private files (such as those with passwords). However, combined with the recent iconv bug in Linux, it turns into the security nightmare of remote code execution."

Here are the product versions affected by CosmicSting:

  • Adobe Commerce 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  • Adobe Commerce Extended Support 2.4.3-ext-7 and earlier, 2.4.2-ext-7 and earlier, 2.4.1-ext-7 and earlier, 2.4.0-ext-7 and earlier, 2.3.7-p4-ext-7 and earlier.
  • Magento Open Source 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  • Adobe Commerce Webhooks Plugin versions 1.2.0 to 1.4.0

If your business is running any of the above, make sure to apply the patch - which was already made available - as soon as possible.

Sansec says that despite the vulnerability being made public more than a week ago, some 75% of Adobe Commerce and Magento users are yet to patch up. There is currently no evidence of in-the-wild abuse, and Adobe did not publish technical details so at to not give hackers any hints. However, Sansec says that the patch can be reverse-engineered and used to learn more about the bug. 

Those who are unable to apply the patch immediately are advised to apply the mitigations found on this link. 

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.