CosmicSting (Adobe Commerce XXE)

aka CosmicSting, APSB24-40

Product: Adobe Adobe Commerce / Magento Open Source
CVE: CVE-2024-34102
Disclosed: 2024-06-11
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier
Fixed: 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 (+ isolated patch)

Summary

A pre-auth XXE in Magento's REST API lets attackers read app/etc/env.php, steal the crypt key and forge admin API tokens. Combined with the glibc iconv bug CVE-2024-2961 it becomes full RCE; Sansec reported thousands of stores hacked, including big brands.

Root cause

Unauthenticated REST endpoints (e.g. guest-carts estimate-shipping-methods) deserialize nested JSON into objects, letting the attacker instantiate SimpleXMLElement with controlled data and LIBXML_NOENT options. External entities are then resolved, exfiltrating local files out-of-band.

Impact

Unauthenticated file read and admin API takeover; RCE when chained with CVE-2024-2961.

Public PoC

# Unauthenticated REST endpoint, e.g.
POST /rest/V1/guest-carts/1/estimate-shipping-methods
# nested JSON instantiates SimpleXMLElement with attacker XML (sourceData / dataIsURL)
# blind XXE with out-of-band exfiltration:
<!ENTITY file SYSTEM "../app/etc/env.php">
# -> 'crypt' => ['key' => '...']  -> forge admin JWT for REST/GraphQL/SOAP

Source: spacewasp (original finder) / CVE-2024-34102 writeup

Detection

Inspect REST API requests for 'sourceData', 'dataIsURL' or '<!ENTITY' strings in JSON bodies. nuclei template CVE-2024-34102.

Mitigation

Apply APSB24-40 patches and rotate the crypt key (bin/magento encryption:key:change) since stolen keys survive patching.