Critical Magento XXE Enables Admin API Takeover and Potential RCE

Adobe disclosed CVE-2024-34102, a critical (CVSS 9.8) pre-authentication XML external entity (XXE) flaw in Adobe Commerce and Magento. The vulnerability lies in recursive REST API deserialization and can be reached through an unauthenticated guest-cart shipping-estimation endpoint, allowing attacker-controlled data to instantiate SimpleXMLElement objects and retrieve local or remote resources.

An attacker could use the flaw to read Magento's app/etc/env.php, exposing the installation's cryptographic key and potentially enabling forged administrator JWTs for privileged Magento API access. Research further indicates the issue could be chained with PHP filter techniques and CVE-2024-2961 toward remote code execution; organizations should apply Adobe's security update, as early third-party emergency mitigations were bypassable and later revised.