CVE-2024-34102
CriticalPublished
XXE can expose crypt key and other secrets granting full admin access
- Published
- Jun 13, 2024
- Updated
- Oct 21, 2025
- Assigning CNA
- adobe
- Evidence observed
- Jul 17, 2024
Primary CVSS
9.8/ 10Critical
XXE can expose crypt key and other secrets granting full admin access
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
http/cves/2024/CVE-2024-34102.yaml
CVE-2024-34102 (Magento XXE)
Proof-of-concept for CVE-2024-34102 exploiting unauthenticated Magento XXE and WAF bypass by sending a crafted request to the estimate-shipping-methods endpoint and returning an HTTP callback to the attacker's webhook.
POC for CVE-2024-34102. A pre-authentication XML entity injection issue in Magento / Adobe Commerce.
Educational slides and demo material explaining the CosmicSting XXE vulnerability (CVE-2024-34102) in Adobe Commerce and Magento, including exploit demonstration for security awareness.
Exploitation CVE-2024-34102
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.
A PoC demonstration , critical XML entity injection vulnerability in Magento
Adobe Commerce XXE exploit
CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento (CVE-2024-34102)
Go-based exploit for CVE-2024-34102, an XXE vulnerability in Adobe Commerce leading to remote code execution. Supports single and batch URL scanning with SSRF file reading.
Proof-of-concept exploit for CVE-2024-34102, a critical XML entity injection in Magento, enabling exfiltration of sensitive files and unauthorized admin access. For educational use.
CVE-2024-34102 exploit for python3
Complete CosmicSting (CVE-2024-34102) exploit suite for Magento/Adobe Commerce XXE vulnerability
CosmicSting (CVE-2024-34102) POC / Patch Validator
CVE-2024-34102: Unauthenticated Magento XXE
Burp Suite extension for detecting and testing CVE-2024-34102, a critical web vulnerability, enabling automated security assessment and exploitation verification.
Exploit script for CVE-2024-34102, an XXE vulnerability in Adobe Commerce allowing arbitrary code execution via crafted XML documents.
Proof-of-concept exploit for CVE-2024-34102, demonstrating the vulnerability and providing a template for security testing and validation.
Proof-of-concept exploit for CVE-2024-34102, demonstrating exploitation of a specific vulnerability for security testing and research purposes.
poc for CVE-2024-34102