Vulnerabilities · 2026-06-29

CosmicSting (CVE-2024-34102): The Magento XXE Bug Explained

CosmicSting (CVE-2024-34102) is one of the most damaging Magento bugs in years — a critical (CVSS 9.8) XML External Entity (XXE) flaw that lets an unauthenticated attacker read your store's secret encryption key, then chain it into remote code execution and forged admin tokens. Sansec tracked thousands of stores compromised in mass CosmicSting campaigns.

Worried about your store? Run a free MageArgus scan to check your version against CosmicSting's fixed patch levels.

By the numbers

CVSS 9.8 — critical, unauthenticated — Adobe APSB24-40 / NVD
Thousands of stores mass-compromised — Sansec CosmicSting research, 2024

What CosmicSting actually does

The bug is improper restriction of XML external entity references in the Commerce REST API. An attacker sends a crafted request that makes the server resolve an external entity — leaking files, most critically app/etc/env.php and the encryption key. With the key, they can forge admin JWTs and (chained with the glibc iconv bug, CVE-2024-2961) achieve full RCE.

Affected and fixed versions

Fixed in 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 (APSB24-40). Anything below your branch's fixed level is vulnerable. Check with bin/magento --version.

The fix — patch AND rotate the key

This is the critical part: patching alone is not enough. If your key leaked before patching, it stays valid forever. You must patch and rotate:

composer require magento/quality-patches
vendor/bin/magento-patches status   # apply the CosmicSting fix
bin/magento setup:upgrade && bin/magento cache:flush
bin/magento encryption:key:change   # rotate the leaked key

See the full patching guide for safe deployment.

Check for compromise

After patching + rotating, hunt for signs you were already hit: rogue admin users and integration tokens created before the patch date, unknown files in pub/media, and injected skimmer scripts on checkout. If you find any, follow the recovery plan.

Frequently asked questions

I patched months ago — am I safe?

Only if you also rotated the encryption key. If the key leaked before you patched, attackers can still forge admin access until you change it with bin/magento encryption:key:change.

How do I know if I was compromised by CosmicSting?

Look for rogue admins/tokens and unexpected files created around the exposure window. A scan flags web-reachable indicators; the MageArgus module checks the filesystem and database on disk.