Critical XXE Vulnerability Discovered in Adobe Commerce and Magento Open Source

What changed

A significant security flaw has been uncovered in Adobe Commerce and Magento Open Source, specifically related to the improper restriction of XML External Entity references. This vulnerability could lead to arbitrary code execution, posing a serious risk to affected systems.

The affected versions include Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, and 2.4.4-p8, as well as earlier releases. Attackers can exploit this vulnerability by sending specially crafted XML documents that reference external entities, which can be executed without any user interaction.

Who is affected

The vulnerability impacts various users and organizations utilizing Adobe Commerce and Magento Open Source. This includes a wide range of e-commerce businesses that rely on these platforms for their online operations.

Given the popularity of these solutions, many online retailers and service providers may be at risk if they are using the affected versions.

• Adobe Commerce versions 2.4.7 and earlier
• Magento Open Source versions 2.4.7 and earlier
• E-commerce businesses utilizing these platforms
• Developers integrating XML functionalities into their applications

What to do

Organizations using the affected versions of Adobe Commerce and Magento Open Source should take immediate action to mitigate the risks associated with this vulnerability. It is crucial to update to the latest versions provided by Adobe as soon as possible.

Additionally, implementing security best practices, such as validating XML inputs and restricting external entity references, can help protect against potential exploitation.

• Upgrade to the latest versions of Adobe Commerce and Magento Open Source
• Implement input validation for XML documents
• Restrict external entity references in XML processing
• Monitor systems for any unusual activity related to this vulnerability