CosmicSting: Adobe Commerce XXE That Leaks the Crypt Key

What to do

1. Confirm every production and staging store runs a current Adobe Commerce or Magento Open Source patch release.
2. Rotate the encryption key with bin/magento encryption:key:change (or Adobe's environment-variable method on Cloud) and make sure the old key no longer works.
3. Reset all admin passwords and delete any API integration you cannot account for, since their tokens survive key rotation.
4. Review CMS blocks and checkout pages for injected JavaScript and remove it.
5. Update glibc on web servers to close the CVE-2024-2961 path to code execution.

How to check if you are affected or compromised

• Search access logs for POST /rest/V1/guest-carts/<number>/estimate-shipping-methods, which Sansec links to env.php theft even when it returns 404.
• Look for GET /V1/cmsBlock/search and PUT /V1/cmsBlock/<id> calls you did not make, and for scripts appended to the bottom of CMS blocks.
• Check pages and logs for Sansec's skimmer indicators, such as cdnstatics.net/lib.js, statspots.com, jgueurystatic.xyz and form fields ending in -kao153.
• On servers, look for .config/htop/defunct.dat and fake kernel-thread processes such as [kswapd0], left by the CosmicSting plus CNEXT backdoor.

What happened#

On June 11, 2024, Adobe published APSB24-40. Its most serious fix, CVE-2024-34102, is an XML external entity (XXE) flaw in Adobe Commerce and Magento Open Source that needs no login. The CVE record title says it plainly: the XXE "can expose crypt key and other secrets granting full admin access." Adobe scores it CVSS 9.8, and a researcher known as spacewasp reported it. Sansec named it CosmicSting.

Adobe first rated the update priority 3. Public write-ups followed on June 23 and June 26, and Sansec saw attacks start right away. Adobe raised the priority to 1 on July 8, and CISA added the CVE to KEV on July 17. The typical chain reads app/etc/env.php, takes the crypt key, forges an API token, and edits CMS blocks to inject a payment skimmer. From late August, attackers paired it with CVE-2024-2961, a glibc iconv() overflow (the CNEXT technique), to run code on servers.

By October 1, 2024, Sansec counted 4,275 hacked stores, about 5% of all Adobe Commerce and Magento shops, split among seven competing groups. Named victims included National Geographic, Segway, Ray-Ban and Cisco. Further waves in October and November 2024 hit thousands more.

Who is affected#

Adobe Commerce and Magento Open Source 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, plus the 2.4.3-ext and 2.4.2-ext Extended Support lines. The first fixed releases were 2.4.7-p1, 2.4.6-p6, 2.4.5-p8 and 2.4.4-p9. Adobe's knowledge-base article lists even those releases as needing the July 17, 2024 hotfix (AC-12485), which its isolated patch includes.

Do you really need to act?#

The code fix is old, so the question is whether your key is. Adobe says that "to ensure you are still safe after upgrading, you must also rotate your encryption keys." Sansec found that rotating did not by itself stop old keys from working, and that API integration tokens survive rotation. A store that was exposed in mid-2024 and never rotated, or that kept the old key, can still be edited by whoever stole that key. If you can confirm a rotation after patching, removal of the old key, and a clean integration list, you can relax about this CVE. For current stores, the 2026 StyleSmuggler hotfix is the more urgent Magento item.

What to do now#

1. Check the version on every store, staging included: bin/magento --version. On Cloud, run vendor/bin/magento-patches -n status | grep "27015\|Status".
2. Rotate the key: confirm bin/magento list | grep encryption:key:change, then run bin/magento encryption:key:change, following Adobe's rotation guide.
3. Reset admin passwords and review SELECT integration_id, name, email, created_at FROM integration;, deleting anything unknown.
4. Diff CMS blocks and checkout pages against a known-good copy: SELECT block_id, identifier, update_time FROM cms_block ORDER BY update_time DESC;
5. Patch glibc through your distribution so CVE-2024-2961 cannot turn file read into code execution.

How to tell if you were hit#

Sansec flags POST /rest/V1/guest-carts/<number>/estimate-shipping-methods in access logs; a 404 still suggests env.php was read. Look for GET /V1/cmsBlock/search and PUT /V1/cmsBlock/<id> calls you did not make. Skimmers are usually appended to the end of a block; indicators include cdnstatics.net/lib.js, statspots.com and form fields ending in -kao153. On the server, the CNEXT backdoor left .config/htop/defunct.dat and fake [kswapd0] processes.

Timeline#

• Jun 11, 2024 — Adobe publishes APSB24-40 and fixed releases.
• Jun 23, 2024 — Technical details go public; Sansec sees first attacks.
• Jun 27, 2024 — Adobe provides an isolated patch.
• Jul 8, 2024 — Adobe raises the priority to 1.
• Jul 17, 2024 — CISA adds the CVE to KEV; Adobe ships hotfix AC-12485.
• Aug 27, 2024 — Sansec sees CosmicSting combined with CNEXT for code execution.
• Oct 1, 2024 — Sansec reports 4,275 compromised stores.

Vulnerability records

• CVE-2024-34102 · KEV 2024-07-17 · Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE')…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe — APSB24-40: Security update available for Adobe Commerce (archived copy) web.archive.org
2. Adobe Experience League — Security update for Adobe Commerce APSB24-40, revised to include isolated patch for CVE-2024-34102 experienceleague.adobe.com
3. Adobe Experience League — Troubleshooting encryption key rotation: CVE-2024-34102 experienceleague.adobe.com
4. CVE record — CVE-2024-34102 cve.org
5. NVD — CVE-2024-34102 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-34102 cisa.gov
7. CVE record — CVE-2024-2961 (glibc iconv) cve.org
8. Sansec — CosmicSting attack and defense overview sansec.io
9. Sansec — Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns sansec.io