CVE-2024-34104: Adobe Commerce Auth Bypass Vulnerability

CVE-2024-34104 Overview

CVE-2024-34104 is an Improper Authorization vulnerability [CWE-285] affecting Adobe Commerce and Magento Open Source. The flaw allows a remote, unauthenticated attacker to bypass security controls and access functionality or data that should be restricted. Adobe published the issue on June 13, 2024 as part of security bulletin APSB24-40.

Affected versions include Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier releases. Exploitation requires no user interaction and no prior privileges, making the vulnerability attractive for opportunistic attackers targeting internet-facing storefronts.

Critical Impact
A remote attacker can bypass authorization controls over the network without authentication, compromising the confidentiality and integrity of an Adobe Commerce or Magento storefront.

Affected Products

Adobe Commerce (versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier)
Adobe Commerce Webhooks
Magento Open Source (versions 2.4.4 through 2.4.7-b1)

Discovery Timeline

2024-06-13 - CVE-2024-34104 published to NVD alongside Adobe Security Bulletin APSB24-40
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-34104

Vulnerability Analysis

The vulnerability is classified as Improper Authorization [CWE-285] within Adobe Commerce and Magento Open Source. Authorization checks fail to properly validate whether a requester is permitted to perform an action or access a resource. An attacker reaching the affected endpoints over the network can bypass these checks without authenticating.

The scope of impact covers confidentiality and integrity. An attacker can read protected data and alter application state, but the flaw does not directly enable denial of service. Because the issue resides in server-side authorization logic, traditional client-side controls do not mitigate it.

Adobe Commerce Webhooks is also listed as an affected component, indicating the authorization gap may extend to webhook-handling code paths that process inbound or outbound integration traffic.

Root Cause

The root cause is missing or incorrect authorization enforcement on one or more request handlers in Adobe Commerce. The application accepts requests and processes them without confirming that the caller possesses the required role, permission, or session context. Adobe has not published low-level technical details to preserve customer safety prior to patch adoption.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends crafted HTTP requests to an exposed Adobe Commerce or Magento endpoint to invoke restricted functionality. No social engineering or user interaction is required. Because Adobe Commerce stores typically run on the public internet, exposure is significant for unpatched deployments.

No public proof-of-concept is currently linked in NVD references, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical specifics are available in the Adobe Security Advisory APSB24-40.

Detection Methods for CVE-2024-34104

Indicators of Compromise

Unexpected administrative or privileged actions performed without a corresponding authenticated admin session in Magento logs.
Anomalous requests to webhook, REST, or GraphQL endpoints from unfamiliar source IPs at high frequency.
New or modified admin accounts, customer records, or order data without matching access logs.
Outbound webhook traffic to attacker-controlled hosts not configured by store administrators.

Detection Strategies

Review var/log/exception.log, var/log/system.log, and web server access logs for unusual request patterns to /rest/, /graphql, and webhook URLs.
Compare admin and customer table changes against approved change tickets to identify unauthorized modifications.
Inspect Adobe Commerce Webhooks configuration for unknown endpoints, headers, or payload templates.
Correlate authentication events with privileged actions to identify operations performed without a valid session.

Monitoring Recommendations

Forward Magento application logs and web server access logs to a centralized SIEM for retention and correlation.
Alert on spikes in 200-status responses to sensitive endpoints from single source IPs.
Monitor for repeated requests with manipulated path parameters, headers, or JSON payloads targeting authorization-sensitive endpoints.

How to Mitigate CVE-2024-34104

Immediate Actions Required

Apply the security patches referenced in Adobe Security Advisory APSB24-40 without delay.
Inventory all Adobe Commerce and Magento Open Source instances, including staging and development copies, and confirm the running version.
Rotate admin credentials, API tokens, and integration secrets after patching to invalidate any access an attacker may have obtained.
Review admin user lists and recent order, customer, and configuration changes for evidence of unauthorized modification.

Patch Information

Adobe addressed CVE-2024-34104 in the June 2024 security release. Administrators should upgrade to Adobe Commerce versions later than 2.4.7, 2.4.6-p5, 2.4.5-p7, and 2.4.4-p8, or apply the corresponding patches for Magento Open Source. Full version and patch guidance is provided in Adobe Security Advisory APSB24-40.

Workarounds

Restrict access to admin and integration endpoints using a web application firewall (WAF) with IP allowlisting where feasible.
Place the storefront behind a reverse proxy that enforces additional authentication on sensitive paths until patches are deployed.
Disable unused Adobe Commerce Webhooks integrations to reduce exposed authorization surface.
Increase log verbosity and review frequency for authorization-sensitive endpoints during the patching window.

bash

# Apply Adobe Commerce composer patch and clear caches
composer require magento/product-community-edition:2.4.7-p1 --no-update
composer update
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush