:quality(75))
June 2024 brought CVE-2024-34102, widely known as CosmicSting: unauthenticated XML External Entity (XXE) injection on specific endpoints, actively exploited in the wild. Adobe fixed it in the 11 June 2024 security patches, and followed on 28 June with an isolated patch for stores that could not take the full line updates immediately.
What it actually looked like
Not sophisticated zero-day chaining. Operational gaps: unpatched stores, over-permissive credentials, not enough monitoring. Where attackers gained a foothold we often found webshells dropped into writable paths — pub/media, var — admin users nobody could account for, and outbound connections to unfamiliar hosts.
Containment
Our guidance to clients ran on two tracks. The first was stopping the bleeding: patch to the current 2.4.7 or 2.4.6 p-lines, or apply the isolated fix; reset and rotate every key, including API keys, webhooks, service accounts and CI/CD; audit admin users and access logs. Then file integrity checks to catch webshells and unexpected changes, and on cloud, working with support to scan images and review WAF logs for indicators of compromise.
Hardening
The second track was reducing blast radius so the next one costs less. Least privilege for service accounts, CIDR-restricted admin access, mandatory 2FA, and secrets kept out of repositories. Past the basics: CSP reporting enabled, unusual GraphQL patterns monitored, and egress filtering where feasible to block command-and-control callbacks.
Recommended steps
Patch now to current p-lines, or apply Adobe's isolated patch — and verify the build artifact actually contains the fix.
Rotate keys and secrets: payment gateways, shipping, tax, search, webhooks and CI/CD tokens.
Audit admin users and permissions; remove stale accounts; enforce 2FA.
Scan pub/media and var for webshells and unexpected file changes; review web server logs for suspicious requests.
Harden the perimeter: enable and adjust WAF rules, tighten CSP, restrict admin by IP, add egress controls.
On a multi-brand estate, roll out in waves with a monitoring checkpoint between each one. The lesson of CosmicSting is not that the vulnerability was clever. It is that disciplined patching and access hygiene beat most opportunistic attacks.