Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Overview CVE-2024-20759 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier. The vulnerability exists in form fields that are accessible to high-privileged users, allowing an attacker to inject malicious scripts that are stored and later executed in the browser of any victim who visits the affected page [1].

Exploitation

Prerequisites Exploitation requires a high-privileged account, such as an administrator, to inject the malicious payload into the vulnerable form fields. The attack does not require user interaction beyond visiting the page containing the injected script, making it a stored/persistent XSS [1].

Impact

Successful exploitation can lead to arbitrary JavaScript execution in the victim's browser, which may result in theft of sensitive session tokens, unauthorized actions performed under the victim's identity, or defacement. The CVSS assessment indicates high impact on both confidentiality and integrity due to the attacker's elevated privileges [1].

Mitigation

Adobe has released patched versions to address this issue. Users are advised to upgrade to Adobe Commerce 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, or later, and avoid using the beta version 2.4.7-beta3 in production. The official source code repository contains the fix for Magento Open Source [2].