---
title: "CosmicSting: Adobe Commerce XXE That Leaks the Crypt Key"
url: https://erroneo.us/security/briefs/adobe-commerce-magento-cosmicsting-cve-2024-34102-xxe/
description: "Unauthenticated XXE in Adobe Commerce and Magento 2.4.7 and earlier leaks the crypt key; 4,000+ stores skimmed. Patched 2024; confirm the key was rotated."
type: security-brief
section: "Security Digest"
date_published: 2024-06-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-34102"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# CosmicSting: Adobe Commerce XXE That Leaks the Crypt Key

**Verdict: Check exposure.** Upgrading closed the hole in 2024, but a store that never rotated its encryption key, or that kept the old one, can still be hijacked with a key stolen back then.

- **Who must act:** Adobe Commerce and Magento Open Source merchants who ran 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 or earlier after June 2024 and have not since rotated the crypt key and removed old keys and integrations.
- **Who can relax:** Stores on a current patch release that rotated the encryption key after patching, removed the old key, and found no unknown integrations or altered CMS blocks.
- **Affected:** Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier; Adobe Commerce 2.4.3-ext-7 and 2.4.2-ext-7 and earlier (Extended Support); Magento Open Source 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier
- **Fixed:** Adobe Commerce and Magento Open Source 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9; Adobe Commerce 2.4.3-ext-8, 2.4.2-ext-8; Isolated patch for 2.4.4 to 2.4.7 (VULN-27015, which includes the July 17, 2024 hotfix AC-12485)
- **CVEs:** CVE-2024-34102
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm every production and staging store runs a current Adobe Commerce or Magento Open Source patch release.
2. Rotate the encryption key with bin/magento encryption:key:change (or Adobe's environment-variable method on Cloud) and make sure the old key no longer works.
3. Reset all admin passwords and delete any API integration you cannot account for, since their tokens survive key rotation.
4. Review CMS blocks and checkout pages for injected JavaScript and remove it.
5. Update glibc on web servers to close the CVE-2024-2961 path to code execution.

### How to check if you are affected

- Search access logs for POST /rest/V1/guest-carts/<number>/estimate-shipping-methods, which Sansec links to env.php theft even when it returns 404.
- Look for GET /V1/cmsBlock/search and PUT /V1/cmsBlock/<id> calls you did not make, and for scripts appended to the bottom of CMS blocks.
- Check pages and logs for Sansec's skimmer indicators, such as cdnstatics.net/lib.js, statspots.com, jgueurystatic.xyz and form fields ending in -kao153.
- On servers, look for .config/htop/defunct.dat and fake kernel-thread processes such as [kswapd0], left by the CosmicSting plus CNEXT backdoor.

## What happened

On June 11, 2024, Adobe published [APSB24-40](https://web.archive.org/web/20260114015653/https://helpx.adobe.com/security/products/magento/apsb24-40.html). Its most serious fix, CVE-2024-34102, is an XML external entity (XXE) flaw in Adobe Commerce and Magento Open Source that needs no login. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-34102) title says it plainly: the XXE "can expose crypt key and other secrets granting full admin access." Adobe scores it CVSS 9.8, and a researcher known as spacewasp reported it. Sansec named it CosmicSting.

Adobe first rated the update priority 3. Public write-ups followed on June 23 and June 26, and [Sansec](https://sansec.io/research/cosmicsting) saw attacks start right away. Adobe raised the priority to 1 on July 8, and CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102) on July 17. The typical chain reads `app/etc/env.php`, takes the crypt key, forges an API token, and edits CMS blocks to inject a payment skimmer. From late August, attackers paired it with CVE-2024-2961, a [glibc iconv() overflow](https://www.cve.org/CVERecord?id=CVE-2024-2961) (the CNEXT technique), to run code on servers.

By October 1, 2024, [Sansec counted](https://sansec.io/research/cosmicsting-fallout) 4,275 hacked stores, about 5% of all Adobe Commerce and Magento shops, split among seven competing groups. Named victims included National Geographic, Segway, Ray-Ban and Cisco. Further waves in October and November 2024 hit thousands more.

## Who is affected

Adobe Commerce and Magento Open Source 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, plus the 2.4.3-ext and 2.4.2-ext Extended Support lines. The first fixed releases were 2.4.7-p1, 2.4.6-p6, 2.4.5-p8 and 2.4.4-p9. Adobe's [knowledge-base article](https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/security-update-available-for-adobe-commerce-apsb24-40-revised-to-include-isolated-patch-for-cve-2024-34102) lists even those releases as needing the July 17, 2024 hotfix (AC-12485), which its isolated patch includes.

## Do you really need to act?

The code fix is old, so the question is whether your key is. Adobe says that "to ensure you are still safe after upgrading, you must also rotate your encryption keys." Sansec found that rotating did not by itself stop old keys from working, and that API integration tokens survive rotation. A store that was exposed in mid-2024 and never rotated, or that kept the old key, can still be edited by whoever stole that key. If you can confirm a rotation after patching, removal of the old key, and a clean integration list, you can relax about this CVE. For current stores, the 2026 [StyleSmuggler](https://erroneo.us/security/briefs/magento-stylesmuggler-cve-2026-75650-zero-day-rce/) hotfix is the more urgent Magento item.

## What to do now

1. Check the version on every store, staging included: `bin/magento --version`. On Cloud, run `vendor/bin/magento-patches -n status | grep "27015\|Status"`.
2. Rotate the key: confirm `bin/magento list | grep encryption:key:change`, then run `bin/magento encryption:key:change`, following Adobe's [rotation guide](https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/troubleshooting-encryption-key-rotation-cve-2024-34102).
3. Reset admin passwords and review `SELECT integration_id, name, email, created_at FROM integration;`, deleting anything unknown.
4. Diff CMS blocks and checkout pages against a known-good copy: `SELECT block_id, identifier, update_time FROM cms_block ORDER BY update_time DESC;`
5. Patch glibc through your distribution so CVE-2024-2961 cannot turn file read into code execution.

## How to tell if you were hit

Sansec flags `POST /rest/V1/guest-carts/<number>/estimate-shipping-methods` in access logs; a 404 still suggests `env.php` was read. Look for `GET /V1/cmsBlock/search` and `PUT /V1/cmsBlock/<id>` calls you did not make. Skimmers are usually appended to the end of a block; indicators include `cdnstatics.net/lib.js`, `statspots.com` and form fields ending in `-kao153`. On the server, the CNEXT backdoor left `.config/htop/defunct.dat` and fake `[kswapd0]` processes.

## Timeline

- Jun 11, 2024 — Adobe publishes APSB24-40 and fixed releases.
- Jun 23, 2024 — Technical details go public; Sansec sees first attacks.
- Jun 27, 2024 — Adobe provides an isolated patch.
- Jul 8, 2024 — Adobe raises the priority to 1.
- Jul 17, 2024 — CISA adds the CVE to KEV; Adobe ships hotfix AC-12485.
- Aug 27, 2024 — Sansec sees CosmicSting combined with CNEXT for code execution.
- Oct 1, 2024 — Sansec reports 4,275 compromised stores.

## Sources

1. [Adobe — APSB24-40: Security update available for Adobe Commerce (archived copy)](https://web.archive.org/web/20260114015653/https://helpx.adobe.com/security/products/magento/apsb24-40.html)
2. [Adobe Experience League — Security update for Adobe Commerce APSB24-40, revised to include isolated patch for CVE-2024-34102](https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/security-update-available-for-adobe-commerce-apsb24-40-revised-to-include-isolated-patch-for-cve-2024-34102)
3. [Adobe Experience League — Troubleshooting encryption key rotation: CVE-2024-34102](https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/troubleshooting-encryption-key-rotation-cve-2024-34102)
4. [CVE record — CVE-2024-34102](https://www.cve.org/CVERecord?id=CVE-2024-34102)
5. [NVD — CVE-2024-34102](https://nvd.nist.gov/vuln/detail/CVE-2024-34102)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-34102](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102)
7. [CVE record — CVE-2024-2961 (glibc iconv)](https://www.cve.org/CVERecord?id=CVE-2024-2961)
8. [Sansec — CosmicSting attack and defense overview](https://sansec.io/research/cosmicsting)
9. [Sansec — Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns](https://sansec.io/research/cosmicsting-fallout)

---
Source page: https://erroneo.us/security/briefs/adobe-commerce-magento-cosmicsting-cve-2024-34102-xxe/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt