CosmicSting (CVE-2024-34102): XXE to encryption-key theft to RCE
Magekwik Security 8 min read
An unauthenticated XML external entity flaw that reads any file on the server — including the encryption key that protects customer data. Combined with a second bug it becomes full remote code execution. What it is, who got hit, and how to remediate.
What CosmicSting is
CVE-2024-34102 (CosmicSting) is an unauthenticated XML External Entity (XXE) vulnerability in Adobe Commerce and Magento Open Source, rated CVSS 9.8 and fixed in APSB24-40. On its own it reads arbitrary files from the server. Its real danger is what one of those files contains: the Magento encryption key.
Root cause
Magento's REST API accepts JSON, but the underlying deserialization can be coerced into parsing
XML with external entities enabled. A request whose sourceData smuggles an
XXE payload makes the server resolve an external entity — pointed at a local file — and return or exfiltrate
its contents.
Why file-read becomes game-over
app/etc/env.php, an attacker can forge admin JWTs and integration
tokens, decrypt stored secrets, and pivot to full remote code execution. A "read-only" bug becomes a total
compromise. This is why patching alone isn't enough — you must rotate the key.How attackers abuse it
- Send an unauthenticated request carrying an XXE entity that references a local path or an attacker DTD.
- The server resolves it and leaks the file (classic or out-of-band XXE), harvesting the crypt key.
- The key is used to mint valid tokens → admin access → web shell and skimmer injection.
Public validators and proof-of-concept code (see references) demonstrate the callback pattern: a vulnerable
server fetches an attacker-hosted .dtd, proving exposure without touching customer data. Cisco
Talos published Snort coverage for the /rest/V1/guest-carts/ URI pattern seen in live attacks.
Who got hit
CosmicSting drove mass exploitation through 2024; Sansec and Adobe both tracked large-scale scanning and key theft, and it sits on CISA's Known Exploited Vulnerabilities catalog. Many stores that "patched" were still compromised because they never rotated the leaked key.
Am I affected & how to check
Affected: 2.4.7 and earlier without the isolated CVE-2024-34102 patch. The fix is version-specific (2.4.7-p1 / 2.4.6-p6 / 2.4.5-p8 / 2.4.4-p9 and later, or the standalone hotfix). Confirm the exact patch on the box rather than trusting the branch:
composer show magento/product-community-edition # or -enterprise-edition
bin/magento setup:upgrade && bin/magento cache:flush
# Rotate the encryption key — a patch does NOT undo a key stolen pre-patch:
bin/magento config:set ... # follow Adobe's key-rotation guidance / re-encryptHow to fix it — in order
- Apply the isolated CVE-2024-34102 patch (APSB24-40) or upgrade to a fixed release; rebuild.
- Rotate the encryption key and re-encrypt secrets. This is the step most stores skip.
- Invalidate admin sessions and integration tokens; audit for rogue admins and injected scripts.
References & sources
Primary sources — advisories, vendor research, and the CVE record. Verify against these, not us.