CVE-2024-34110
📋 TL;DR
This vulnerability allows high-privilege attackers to upload malicious files to Adobe Commerce systems, potentially leading to arbitrary code execution. Affected versions include Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier. Exploitation does not require user interaction.
💻 Affected Systems
- Adobe Commerce
- Magento Open Source
📦 What is this software?
Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the Adobe Commerce instance, potentially leading to data theft, website defacement, or further network penetration.
Likely Case
Attacker uploads web shell or malicious script to execute arbitrary commands, potentially compromising customer data, payment information, or administrative functions.
If Mitigated
With proper file upload restrictions and privilege separation, impact limited to file system access within restricted directories.
🎯 Exploit Status
Exploitation requires authenticated high-privilege access but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Adobe Commerce 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 or later
Vendor Advisory: https://helpx.adobe.com/security/products/magento/apsb24-40.html
Restart Required: Yes
Instructions:
1. Backup your Adobe Commerce instance and database. 2. Apply the security patch via Composer: composer require magento/product-community-edition=2.4.7-p1 (adjust version as needed). 3. Run setup upgrade: bin/magento setup:upgrade. 4. Clear cache: bin/magento cache:clean. 5. Restart web server services.
🔧 Temporary Workarounds
Restrict File Upload Types
allImplement server-side validation to restrict allowed file upload types to only necessary extensions.
# Configure web server (Apache example) to restrict uploads
<Location "/media/">
SetHandler none
AddType text/plain .php .php3 .php4 .php5 .phtml .pl .py .jsp .asp .htm .html .shtml .sh .cgi
</Location>
Implement File Upload Sanitization
allAdd custom validation to strip executable permissions from uploaded files and store them outside web root.
# Example PHP validation snippet
if (in_array($fileExtension, ['php', 'php3', 'php4', 'php5', 'phtml', 'pl', 'py', 'jsp', 'asp', 'sh', 'cgi'])) {
throw new \Exception('Dangerous file type not allowed');
}
🧯 If You Can't Patch
- Implement strict access controls and monitor admin user activities for suspicious file uploads
- Deploy web application firewall (WAF) rules to block malicious file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check Adobe Commerce version via admin panel or run: php bin/magento --versionCheck Version:
php bin/magento --versionVerify Fix Applied:
Verify version is updated to patched version and test file upload functionality with restricted file types📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to media directories
- Admin user uploading unexpected file types
- POST requests with file uploads containing executable extensions
Network Indicators:
- HTTP POST requests with file uploads to admin endpoints
- Unusual outbound connections from web server after file uploads
SIEM Query:
source="web_access_logs" AND (uri_path="/admin/*/upload" OR uri_path="/media/*") AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp" OR file_extension="py")