Executive Summary

On June 11th, Adobe released a security bulletin covering several vulnerabilities in their Magento, Commerce, and Commerce Webhooks Plugin software. 

There were ten vulnerabilities, seven of which had a CVSS severity of “critical”, with scores of 8 or above. All these critical vulnerabilities were remotely reachable, and three required no credentials. The vulnerabilities were discovered and reported by third-party researchers through bug bounty program HackerOne, so technical details of the vulnerabilities were not publicly disclosed. However, the patches are public and we expect capable threat actors to study the patches to develop and deploy weaponized exploits in the coming days. 

Given these factors, Beazley Security believes rapid deployment of Adobe provided updates as soon as possible. 

Affected Systems or Products

The vulnerability affects the following Adobe Commerce related products:   

Product 

Version 

Platform 

 Adobe Commerce 

2.4.7 and earlier  2.4.6-p5 and earlier  2.4.5-p7 and earlier  2.4.4-p8 and earlier  2.4.3-ext-7 and earlier*  2.4.2-ext-7 and earlier*  2.4.1-ext-7 and earlier*  2.4.0-ext-7 and earlier*  2.3.7-p4-ext-7 and earlier* 

All 

Magento Open Source 

2.4.7 and earlier  2.4.6-p5 and earlier  2.4.5-p7 and earlier  2.4.4-p8 and earlier 

All 

Adobe Commerce Webhooks Plugin 

1.2.0 to 1.4.0 

Manual Plugin Installation 

A breakdown of the individual CVEs follows: 

CVE ID 

CVSS Severity 

Base Score 

Category 

CVE-2024-34102 

Critical 

9.8 

Improper Restriction of XML External Entity Reference 

CVE-2024-34108 

Critical 

9.1 

Improper Input Validation 

CVE-2024-34111 

Critical 

8.5 

Server-Side Request Forgery (SSRF) 

CVE-2024-34104 

Critical 

8.2 

Improper Authorization 

CVE-2024-34103 

Critical 

8.1 

Improper Authentication 

CVE-2024-34109 

Critical 

8.0 

Improper Input Validation 

CVE-2024-34110 

Critical 

8.0 

Unrestricted Upload of File with Dangerous Type 

CVE-2024-34105 

Important 

4.8 

Cross-site Scripting (Stored XSS) 

CVE-2024-34106 

Important 

5.3 

Improper Authentication 

CVE-2024-34107 

Important 

5.3 

Improper Access Control 

Patches

Adobe has released official software updates. Instructions for updating Commerce and Magento can be found here. Instructions for updating Commerce Webhooks Plugin can be found here. 

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices discovered by our Attack Surface Management Solution, Karma, to identify potentially impacted devices and support organizations in remediation of any issues found.

Sources