CVE-2024-45117 Overview
CVE-2024-45117 is an improper input validation vulnerability [CWE-20] affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an authenticated administrator to read arbitrary files from the underlying file system by abusing PHP filter chains. Successful exploitation reads files outside of intended directories and can also cause a low-availability impact on the service. The vulnerability affects Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier releases across the 2.3.x and 2.4.x branches, as well as several Adobe Commerce B2B versions. Adobe addressed the issue in the Adobe Magento Security Advisory APSB24-73.
Critical Impact
An authenticated admin attacker can read sensitive files, including configuration data, credentials, and cryptographic keys, from anywhere on the Adobe Commerce host.
Affected Products
- Adobe Commerce 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier (including all 2.3.7 patch levels)
- Adobe Commerce B2B 1.3.3, 1.3.4, 1.3.5, 1.4.2 and their patch releases
- Magento Open Source 2.4.4 through 2.4.7-p2 and earlier releases
Discovery Timeline
- 2024-10-10 - CVE-2024-45117 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45117
Vulnerability Analysis
The vulnerability stems from insufficient validation of user-supplied input reaching a PHP stream context in Adobe Commerce. An admin-authenticated attacker can craft a request that passes a path parameter through the php://filter wrapper, effectively chaining PHP conversion filters to read and encode arbitrary files. Because the scope is changed, the compromise extends beyond the vulnerable component to files owned by other system users, including sensitive artifacts such as app/etc/env.php, session data, and private keys. The improper input validation weakness [CWE-20] allows path components and filter directives to bypass intended directory restrictions imposed by the application.
Root Cause
The root cause is the acceptance of untrusted input into a file-handling API without normalizing or allowlisting the underlying stream wrapper. When the application invokes a PHP function that supports stream wrappers, an attacker-controlled string beginning with php://filter/ is interpreted as a filter chain rather than a local path. Base64 and similar conversion filters transform binary content into printable output the attacker can retrieve through the admin response.
Attack Vector
Exploitation is network-based and requires an authenticated administrator account. No user interaction is needed. The attacker submits a crafted request to an admin endpoint that consumes a file path, substituting a php://filter/convert.base64-encode/resource=/path/to/target payload. The Adobe Commerce process reads the target file, applies the requested filters, and returns the encoded content in the response. Refer to the Adobe Magento Security Advisory APSB24-73 for vendor-provided details.
Detection Methods for CVE-2024-45117
Indicators of Compromise
- Admin request logs containing the php://filter string, convert.base64-encode, or resource= parameters in request bodies or query arguments.
- Unexpected admin session activity that reads or exports files, especially from accounts that do not normally perform system-level actions.
- Outbound transfer of large base64-encoded blobs from the Adobe Commerce admin interface to non-standard destinations.
Detection Strategies
- Inspect web server and application logs for URI or POST bodies referencing PHP stream wrappers (php://, phar://, zip://).
- Correlate authenticated admin actions with file-read operations touching paths outside pub/media, pub/static, and other expected directories.
- Deploy web application firewall rules that block requests containing php://filter patterns targeting admin endpoints.
Monitoring Recommendations
- Alert on admin logins from new IP addresses or geolocations, particularly followed by requests referencing file paths.
- Monitor read access to sensitive files such as app/etc/env.php, .htaccess, and private keys on the Adobe Commerce host.
- Track anomalous response sizes on admin endpoints that historically return small payloads.
How to Mitigate CVE-2024-45117
Immediate Actions Required
- Apply the Adobe security update from APSB24-73 to all Adobe Commerce, Commerce B2B, and Magento Open Source instances.
- Audit and reduce the number of administrator accounts, and rotate credentials that may have been exposed to any compromised admin session.
- Rotate cryptographic secrets stored in app/etc/env.php, including the crypt key, database credentials, and any API tokens accessible from the host.
Patch Information
Adobe released fixed versions of Adobe Commerce, Commerce B2B, and Magento Open Source alongside advisory APSB24-73. Upgrade to versions later than 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10 on the corresponding branches. Verify the deployed version with bin/magento --version after patching.
Workarounds
- Restrict access to the Adobe Commerce admin panel using IP allowlisting, VPN, or a reverse proxy that enforces MFA.
- Deploy WAF rules that block admin requests containing php://, phar://, or data:// stream wrappers.
- Enforce least privilege for admin roles so that only necessary accounts can invoke file-handling functionality.
# Example WAF rule (ModSecurity) blocking PHP filter chains on admin routes
SecRule REQUEST_URI "@beginsWith /admin" \
"chain,phase:2,deny,status:403,id:1004501,\
msg:'CVE-2024-45117 PHP filter chain attempt'"
SecRule ARGS|REQUEST_BODY "@rx (?i)(php|phar|data|zip)://" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
