CVE-2024-34102

XXE can expose crypt key and other secrets granting full admin access

Basic Information

CVE State: PUBLISHED
Reserved Date: April 30, 2024
Published Date: June 13, 2024
Last Updated: February 13, 2025
Vendor: Adobe
Product: Adobe Commerce
Description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2024-07-17 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2024-06-30 16:49:26 UTC) Source

References

https://helpx.adobe.com/security/products/magento/apsb24-40.html https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102

Known Exploited Vulnerability Information

Source	Added Date
CISA	2024-07-17 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb	2025-04-29 11:01:13 UTC
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34102.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

magento_xxe_to_glibc_buf_overflow

Type: metasploit • Created: Unknown

Metasploit module for CVE-2024-34102

EQSTLab/CVE-2024-34102

Type: github • Created: 2024-08-13 07:33:20 UTC • Stars: 3

Adobe Commerce XXE exploit

bughuntar/CVE-2024-34102

Type: github • Created: 2024-07-13 10:25:23 UTC • Stars: 3

Exploitation CVE-2024-34102

jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

Type: github • Created: 2024-07-01 08:19:28 UTC • Stars: 8

CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento (CVE-2024-34102)

0x0d3ad/CVE-2024-34102

Type: github • Created: 2024-06-30 16:49:26 UTC • Stars: 2

CVE-2024-34102 (Magento XXE)

Chocapikk/CVE-2024-34102

Type: github • Created: 2024-06-28 23:33:21 UTC • Stars: 47

CosmicSting (CVE-2024-34102)

11whoami99/CVE-2024-34102

Type: github • Created: 2024-06-28 12:45:40 UTC • Stars: 3

POC for CVE-2024-34102 : Unauthenticated Magento XXE and bypassing WAF , You will get http connection on ur webhook

bigb0x/CVE-2024-34102

Type: github • Created: 2024-06-27 21:57:24 UTC • Stars: 32

POC for CVE-2024-34102. A pre-authentication XML entity injection issue in Magento / Adobe Commerce.

th3gokul/CVE-2024-34102

Type: github • Created: 2024-06-27 18:10:13 UTC • Stars: 14

CVE-2024-34102: Unauthenticated Magento XXE