Summary:
A critical XML external entity reference (XXE) vulnerability, tracked as CVE-2024-34102, has been exploited to compromise five percent of Adobe Commerce and Magento stores. This vulnerability, dubbed CosmicSting, has been exploited by malicious actors to gain remote code execution on vulnerable systems. The flaw was patched by Adobe on June 27th, 2024, but widespread exploitation has continued. Sansec research discovered seven different groups running large-scale campaigns utilizing this CosmicSting vulnerability.

The vulnerability has been used by threat actors to steal Magento's secret encryption key, which is then used to generate JSON Web Tokens (JWTs) with full administrative API access. This allows attackers to inject malicious scripts into the e-commerce sites. When Adobe issued a critical severity rating on July 8th, automated attacks had already begun and thousands of secret crypt keys had been stolen. When stores updated their systems, existing secret keys were not invalidated automatically, leaving the stores vulnerable to unauthorized modifications. To mitigate this threat, site owners should not only apply the latest patch but also rotate their encryption keys. Recent attacks in August 2024 have chained CosmicSting with CNEXT (CVE-2024-2961), a vulnerability in the GNU C library, to achieve remote code execution. This escalation allows attackers to take full control of the compromised system. The ultimate goal of these attacks is to establish persistent access and steal payment data from users.

Security Officer Comments:
The exploitation of CosmicSting highlights the ongoing threat posed by unpatched instances of software. Despite the availability of a patch, many organizations have failed to implement it fully and promptly, leaving their systems vulnerable to attack. The widespread use of this vulnerability by multiple threat groups underscores the importance of maintaining a resilient security posture, staying up-to-date with the latest security advisories, and properly implementing fixes where applicable. Organizations using Adobe Commerce or Magento should prioritize applying the patch for CVE-2024-34102 and rotating their encryption keys. Additionally, implementing network segmentation practices and intrusion detection systems can help mitigate the risk of exploitation. Sansec projects that more stores will get hacked in the coming months, as 75% of the Adobe Commerce & Magento install base hadn't been patched when the automated scanning for secret encryption keys started.

Suggested Corrections:
IOCs for CosmicSting attacks are published here.

Recommendations on How To Fix from Sansec