CVE-2024-20759: Adobe Commerce Stored XSS Vulnerability

CVE-2024-20759 Overview

CVE-2024-20759 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce and Magento Open Source. The flaw exists in versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier. A high-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The injected script executes in a victim's browser when they visit the page containing the tainted field. Adobe published the fix in security advisory APSB24-18 on April 10, 2024.

Critical Impact
Successful exploitation targets administrative users and can compromise confidentiality and integrity of the Adobe Commerce backend, enabling session theft, admin account takeover, and unauthorized changes to storefront data.

Affected Products

Adobe Commerce 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier
Adobe Commerce 2.3.7 through 2.3.7-p4-ext4
Magento Open Source 2.4.4 through 2.4.7-beta3

Discovery Timeline

2024-04-10 - CVE-2024-20759 published to NVD
2024-04-10 - Adobe releases security advisory APSB24-18
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20759

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Adobe Commerce fails to properly sanitize input in specific administrative form fields before persisting the values. When an admin user later renders the page containing the tainted field, the browser executes the attacker-controlled JavaScript in the context of the Commerce admin session.

Because execution occurs in an authenticated admin browser context, the attacker inherits the victim's privileges. This includes access to customer data, order records, catalog management, and configuration endpoints. The CVSS vector indicates the attack scope is Changed, meaning the injected payload can affect resources beyond the vulnerable component.

Root Cause

The root cause is insufficient output encoding and input validation on admin-facing form fields. User-supplied content is stored in the database and later rendered without contextual escaping. Any HTML or JavaScript in the stored value is interpreted by the browser as executable markup rather than data.

Attack Vector

Exploitation requires an attacker with high privileges on the Commerce admin panel and user interaction from a victim admin. The attacker submits a payload such as an <script> tag or an event-handler attribute into a susceptible form field. The payload persists in the backend. When another admin views the affected page, the payload triggers in their session. Refer to the Adobe advisory APSB24-18 for the specific components addressed by the patch.

Detection Methods for CVE-2024-20759

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handlers (onerror, onload, onmouseover) persisted in Commerce database tables backing admin form fields
Outbound HTTP requests from admin browser sessions to unfamiliar domains shortly after loading Commerce admin pages
New or modified admin accounts, altered API tokens, or configuration changes made shortly after an admin viewed a suspect record
Anomalous session cookie exfiltration patterns in web proxy or EDR telemetry originating from admin workstations

Detection Strategies

Query Commerce database tables (product attributes, CMS blocks, customer fields, order comments) for HTML tags and JavaScript keywords in fields that should contain plain text
Inspect web application firewall (WAF) logs for POST requests to /admin/* endpoints containing script payload signatures
Correlate admin login events with subsequent unexpected privileged actions using SIEM behavioral rules
Review Content Security Policy (CSP) violation reports for inline script executions in the admin panel

Monitoring Recommendations

Enable audit logging on Adobe Commerce admin activity and forward events to a centralized SIEM for retention and correlation
Monitor administrative endpoints for anomalous form submissions and unexpected content types
Alert on privileged admin actions performed outside of business hours or from new IP addresses
Track browser-side runtime anomalies on admin workstations, including credential theft behaviors and unauthorized outbound connections

How to Mitigate CVE-2024-20759

Immediate Actions Required

Apply the security updates listed in Adobe advisory APSB24-18 to all affected Adobe Commerce and Magento Open Source instances
Audit admin user accounts, remove unused high-privileged accounts, and rotate credentials for admins who may have interacted with vulnerable pages
Review recent changes to product attributes, CMS content, and configuration for injected script content and remove any tainted values
Enforce multi-factor authentication (MFA) on all Commerce admin accounts

Patch Information

Adobe released fixed versions on April 10, 2024. Upgrade Adobe Commerce and Magento Open Source to versions later than 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, or 2.4.7-beta3 as directed in APSB24-18. Verify patch application by checking the deployed version via bin/magento --version after upgrade.

Workarounds

Restrict admin panel access using IP allowlisting or a VPN to limit which users can submit form data to backend endpoints
Deploy a Content Security Policy (CSP) that blocks inline scripts in the /admin context
Apply strict least-privilege role assignments so that only trusted administrators hold the permissions required to reach the vulnerable form fields
Deploy a WAF rule set that inspects admin POST bodies for HTML and script payloads

bash

# Verify Adobe Commerce version after patching
bin/magento --version

# Example nginx snippet restricting admin panel by source IP
location ~* ^/admin {
    allow 10.0.0.0/8;
    deny all;
}