Persistent backdoors injected on Adobe Commerce via new CosmicSting attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the… | 7.3 | 88% | ||
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source | 9.8 | 100% | KEVPoC | KEV |
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 99% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 165.231.182.98 | 1bmN0 uY29uZmlnL2h0b3AvZGVmdW5jd LmNvbmZpZy9odG9wL2RlZnVuY3 165.231.182.98 45.10.160.45 193.93.193.74 Read more CosmicSting attack & d |
| ipv4 | 193.93.193.74 | itation Logs reveal attempts to exploit this vulnerability: 193.93.193.74, ::1 - - [09/Aug/2024:00:24:42 +0200] "POST /rest/all/V1/gu |
| ipv4 | 45.10.160.45 | L2h0b3AvZGVmdW5jd LmNvbmZpZy9odG9wL2RlZnVuY3 165.231.182.98 45.10.160.45 193.93.193.74 Read more CosmicSting attack & defense overvi |
From the original article
3 min read at sansec.io
CosmicSting (CVE-2024-34102) allows arbitrary file reading on unpatched systems. When combined with CNEXT (CVE-2024-2961), threat actors can escalate to remote code execution, taking over the entire system. Merchants must patch their systems against both vulnerabilities immediately.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.