Loading vulnerability…
CosmicSting
CosmicSting is an unauthenticated XML external entity (XXE) vulnerability in Adobe Commerce and Magento Open Source. Magento's recursive REST API input deserialization allows attacker-controlled constructor arguments to reach PHP SimpleXMLElement through internal classes, enabling external entity processing and arbitrary file disclosure. A demonstrated entry point is the guest-cart shipping-estimation API. Affected releases include 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier. Exploitation requires no user interaction. Exposed cryptographic keys can enable administrator token forgery; chaining the flaw with CVE-2024-2961 can enable remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can disclose local files and sensitive configuration, including credentials and the cryptographic key used to sign Magento authentication tokens. A stolen signing key can enable forged administrator JWTs and privileged API access, facilitating malicious storefront modifications and payment-skimmer injection. Exploitation has resulted in customer payment-data theft. Arbitrary code execution is identified as a potential impact, with observed and demonstrated remote-code-execution chains using the separate CNEXT vulnerability, CVE-2024-2961. Patching does not automatically invalidate previously stolen cryptographic keys, so unauthorized access can persist after an update.
If you can’t patch tonight, do this now.
Until patching is complete, limit access to administrative interfaces and monitor for suspicious API activity and unauthorized storefront changes. Use only current vendor-supported mitigation guidance: early emergency filters targeting individual input keywords were bypassed and subsequently revised. Malware and vulnerability monitoring can help identify compromise but does not replace patching and key invalidation.
Patch, then assume compromise.
Upgrade Adobe Commerce or Magento Open Source to a supported fixed release. Listed fixed releases include 2.4.7-p1, 2.4.6-p6, 2.4.5-p8 and 2.4.4-p9; Adobe Commerce extended-support fixes also include 2.4.3-ext-8 and 2.4.2-ext-8. If an immediate upgrade is not possible, apply Adobe's isolated patch ACSD-60241 for applicable versions 2.4.4 through 2.4.7. Rotate encryption keys and explicitly invalidate or remove old keys using Adobe's guidance. Investigate exposed deployments for unauthorized API activity, storefront modifications, skimmers and backdoors. Patch CVE-2024-2961 in affected glibc installations to prevent the documented remote-code-execution chain.
15 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.