CVE-2024-34102: Magento Open Source Improper Restriction of XML External Entity Reference ('XXE') Vulnerability
Summary
CVE-2024-34102: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. Affects magento/community-edition across 3 version ranges.
< 2.4.4-p9
>= 2.4.5-p1, < 2.4.5-p8
>= 2.4.6-p1, < 2.4.6-p6
Fixed in 2.4.4-p9, 2.4.5-p8 or 2.4.6-p6, depending on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-34102 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Magento Open Source is an open-source e-commerce platform that provides a range of features for online businesses. It allows merchants to create and manage their online stores, handle product catalogs, process payments, and more. This vulnerability affects versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier of Magento Open Source.
Vulnerability Detail
The vulnerability in Magento Open Source is an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. It allows an attacker to execute arbitrary code by exploiting a flaw in the processing of XML documents. By sending a specially crafted XML document that references external entities, an attacker can trigger the vulnerability. The exploitation of this issue does not require any user interaction.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p92.4.4-p9composer require magento/community-edition:2.4.4-p9 -
>= 2.4.5-p1, < 2.4.5-p82.4.5-p8composer require magento/community-edition:2.4.5-p8 -
>= 2.4.6-p1, < 2.4.6-p62.4.6-p6composer require magento/community-edition:2.4.6-p6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment.
Conclusion
The XXE vulnerability in Magento Open Source can lead to arbitrary code execution and poses a significant risk to online stores using affected versions. It is crucial to update to the patched versions and regularly apply updates to protect against this and other vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
An XXE vulnerability is a type of security flaw that allows an attacker to exploit the processing of XML documents by referencing external entities. This can lead to arbitrary code execution and other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your Magento Open Source installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze and alert you if any open-source vulnerabilities are found.
No, only versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are affected by this XXE vulnerability. It is recommended to update to a patched version to mitigate the risk.
There is no evidence of this vulnerability being actively exploited in the wild at the moment. However, it is crucial to apply the necessary patches and updates to protect your Magento Open Source installation.
You can find more information about this vulnerability, including technical details and the latest updates, in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m8cj-3v68-3cxj/GHSA-m8cj-3v68-3cxj.json
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
