CVE-2024-34105: Magento Open Source Cross-Site Scripting (XSS) vulnerability
Summary
CVE-2024-34105: Magento Open Source Cross-Site Scripting (XSS) vulnerability. Affects magento/community-edition across 3 version ranges.
< 2.4.4-p9
>= 2.4.5-p1, < 2.4.5-p8
>= 2.4.6-p1, < 2.4.6-p6
Fixed in 2.4.4-p9, 2.4.5-p8 or 2.4.6-p6, depending on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-34105 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is an open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It offers various features for managing product catalogs, processing payments, and handling customer orders. However, versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an admin attacker to inject malicious scripts into vulnerable form fields, potentially leading to the execution of malicious JavaScript in a victim's browser when they visit a page containing the vulnerable field.
Vulnerability Detail
The stored Cross-Site Scripting (XSS) vulnerability in Magento Open Source versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier can be exploited by an admin attacker to inject malicious scripts into form fields. When a victim accesses a page containing the vulnerable field, the injected JavaScript may execute in their browser, potentially compromising their session or exposing sensitive information. This vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p92.4.4-p9composer require magento/community-edition:2.4.4-p9 -
>= 2.4.5-p1, < 2.4.5-p82.4.5-p8composer require magento/community-edition:2.4.5-p8 -
>= 2.4.6-p1, < 2.4.6-p62.4.6-p6composer require magento/community-edition:2.4.6-p6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround is to implement input validation and sanitization measures on the affected form fields. This can help prevent the execution of injected scripts. Here is an example of how to sanitize user input in PHP:
$input = $_POST['field'];
$sanitizedInput = htmlspecialchars($input);
// Use $sanitizedInput in your application
Note that this is a temporary solution and should be replaced with the official patch as soon as possible.
Conclusion
Magento Open Source versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an admin attacker to inject malicious scripts into vulnerable form fields, potentially compromising the security of users who access the affected pages. It is crucial to upgrade to a patched version of Magento Open Source or implement temporary mitigations to prevent exploitation.
See every vulnerability recorded for magento/community-edition →
FAQ
Magento Open Source is an open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It offers various features for managing product catalogs, processing payments, and handling customer orders.
A stored Cross-Site Scripting (XSS) vulnerability allows an attacker to inject malicious scripts into a vulnerable application. These scripts are then executed in the browsers of users who access the affected pages, potentially leading to session hijacking, data theft, or other malicious activities.
An admin attacker can exploit this vulnerability by injecting malicious scripts into vulnerable form fields within the Magento Open Source application. When a victim accesses a page containing the affected field, the injected scripts may execute in their browser, allowing the attacker to perform various malicious actions.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level. This score is based on the potential impact and exploitability of the vulnerability.
To mitigate the risk of exploitation, it is recommended to upgrade your Magento Open Source installation to one of the patched versions: 2.4.6-p6, 2.4.5-p8, or 2.4.4-p9. These versions address the vulnerability and provide protection against potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
