Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

CVE-2024-45127 is a stored cross-site scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. The flaw exists in vulnerable form fields where an authenticated admin attacker can inject malicious scripts that remain stored on the application [1].

Exploitation

An attacker with administrative privileges can exploit this by crafting input data containing JavaScript payloads and submitting it via affected form fields. The stored script then activates when a victim (including other administrators or users) views the page containing that form field, leading to arbitrary JavaScript execution within the victim's browser session [1].

Impact

Once executed, the injected script can perform actions on behalf of the victim, such as manipulating page content, stealing session tokens, or accessing sensitive data within the context of the user's session. This could result in privilege escalation or further compromise of the Adobe Commerce instance [1].

Mitigation

Adobe has released security patches for the affected versions. Administrators should upgrade to Adobe Commerce versions not listed as vulnerable. The official GitHub repository for Magento (now Adobe Commerce) provides source code and instructions for maintaining the software [2]. Users should also consider applying input validation and output encoding best practices as a defense-in-depth measure [1].