CVE-2024-45116: Adobe Commerce XSS Vulnerability

CVE-2024-45116 Overview

CVE-2024-45116 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw exists in versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier releases. An authenticated attacker with high administrative privileges can craft a malicious link or form that, when triggered by a victim, executes arbitrary scripts within the victim's browser context. Successful exploitation compromises confidentiality and integrity of the targeted user session. Adobe published the fix under advisory APSB24-73.

Critical Impact
An admin-level attacker can execute arbitrary JavaScript in a victim's browser session, potentially hijacking administrative accounts and manipulating storefront data across Adobe Commerce, Commerce B2B, and Magento Open Source deployments.

Affected Products

Adobe Commerce 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier
Adobe Commerce B2B 1.4.2-p2, 1.3.5-p7, 1.3.4-p9, 1.3.3-p10 and earlier
Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier

Discovery Timeline

2024-10-10 - CVE-2024-45116 published to NVD following Adobe advisory APSB24-73
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45116

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting weakness classified under [CWE-79]. Adobe Commerce fails to properly neutralize user-supplied input before rendering it in a web page served to another user. An attacker with high administrative privileges can inject JavaScript payloads into fields or parameters that are later rendered to a victim's browser without sufficient output encoding.

Exploitation requires user interaction: the victim must click a crafted link or submit a manipulated form. Because the scope changes when the payload executes, the attack can reach browser resources beyond the vulnerable component, including administrative session data and storefront controls.

Root Cause

The root cause is missing or insufficient output encoding on data controlled by an authenticated admin user. Adobe Commerce processes attacker-controlled content through a rendering path that does not apply context-aware sanitization, allowing HTML and JavaScript tokens to be interpreted by the victim's browser rather than displayed as inert text.

Attack Vector

The attack vector is network-based and requires both high privileges on the Commerce backend and user interaction. A malicious administrator crafts a payload delivered through a URL, form submission, or stored administrative field. When another authenticated user opens the affected view, the script executes in that user's browser. Attackers can steal session tokens, perform actions on behalf of the victim, or modify order and catalog data. Confidentiality and integrity impact are rated high while availability is not affected.

No public proof-of-concept or exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-45116

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored in admin-editable fields (product descriptions, CMS blocks, customer attributes).
Admin session cookies observed being transmitted to unfamiliar external domains.
Anomalous administrative actions performed shortly after an admin user opened an internal link or email.

Detection Strategies

Review Adobe Commerce access and admin action logs for unusual URL parameters containing encoded HTML or JavaScript tokens.
Deploy web application firewall rules that inspect POST bodies and query parameters submitted to /admin/ paths for reflected script fragments.
Correlate outbound HTTP requests from browsers of admin users against known Commerce backend hostnames to identify data exfiltration.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions in the admin panel.
Alert on new or modified admin accounts, role assignments, and integration tokens created after suspicious activity.
Monitor var/log/ and reverse-proxy logs for repeated malformed requests to admin endpoints from a single session.

How to Mitigate CVE-2024-45116

Immediate Actions Required

Upgrade Adobe Commerce, Commerce B2B, and Magento Open Source to the patched versions listed in Adobe Security Advisory APSB24-73.
Audit all administrator accounts and revoke unused or excessive privileges, since exploitation requires high privileges.
Rotate admin session secrets, API tokens, and integration keys after patching.

Patch Information

Adobe released fixed builds addressing CVE-2024-45116 in advisory APSB24-73. Administrators should apply the vendor-supplied patch or upgrade to a release later than 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, or 2.4.4-p10 depending on the deployed branch. Refer to the Adobe Security Advisory APSB24-73 for full version mappings and download locations.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Require multi-factor authentication for all administrative logins to reduce the risk of a compromised admin abusing the flaw.
Restrict admin panel access to allow-listed IP addresses or a VPN, limiting the exposure surface until patches are applied.

bash

# Example Nginx allow-list for the Magento admin path
location ~* ^/admin/ {
    allow 203.0.113.0/24;   # corporate egress
    allow 198.51.100.10;    # jump host
    deny  all;
    try_files $uri $uri/ /index.php?$args;
}