CVE-2025-24410 Overview
CVE-2025-24410 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page rendering the affected field. Successful exploitation enables session takeover, with high confidentiality and integrity impact.
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction and authenticated access to a vulnerable form input.
Critical Impact
Authenticated attackers can hijack administrator or customer sessions through stored JavaScript payloads, leading to account takeover and unauthorized actions on Adobe Commerce storefronts.
Affected Products
- Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
- Adobe Commerce B2B versions 1.5.0, 1.4.2-p3, 1.3.5-p8, 1.3.4-p10, 1.3.3-p11 and earlier
- Magento Open Source versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
Discovery Timeline
- 2025-02-11 - CVE-2025-24410 published to NVD
- 2025-04-16 - Last updated in NVD database
Technical Details for CVE-2025-24410
Vulnerability Analysis
The flaw resides in input handling for specific form fields exposed by Adobe Commerce. Attacker-supplied content is stored server-side without sufficient output encoding or input sanitization. When another user loads the page that renders the stored value, the browser parses the injected markup and executes attacker-controlled JavaScript in the victim's session context.
Because the payload is persistent, it triggers automatically on every page view by any user with access to the affected view. The vulnerability changes scope, meaning the injected script can affect resources beyond the originally vulnerable component, including authenticated administrator sessions.
Root Cause
The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. Form field handlers accept HTML and JavaScript characters without contextual escaping. Stored values are later emitted into HTML output without encoding entities such as <, >, ", and ', allowing arbitrary script tags or event handlers to execute.
Attack Vector
An authenticated attacker with low privileges submits a crafted payload through a vulnerable form field, such as fields available to customers or limited backend roles. The payload is persisted in the Adobe Commerce database. When a higher-privileged user, such as a store administrator, navigates to a page that renders the stored content, the embedded JavaScript executes in their browser. The attacker can then exfiltrate session cookies, issue authenticated API requests, or modify storefront content.
The vulnerability mechanism is described in the Adobe Security Advisory for Magento. No public proof-of-concept exploit is currently available.
Detection Methods for CVE-2025-24410
Indicators of Compromise
- Form field values in the Adobe Commerce database containing <script>, javascript:, or HTML event handler attributes such as onerror= and onload=
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing customer or order pages
- Unexpected administrator session activity, including new admin user creation or extension installation
- Web server access logs showing POST requests to form endpoints with encoded script payloads
Detection Strategies
- Audit stored database fields used in customer-facing and admin-facing forms for HTML or JavaScript content that should contain plain text
- Deploy a Content Security Policy (CSP) in report-only mode to log script execution from inline sources or untrusted origins
- Inspect Adobe Commerce web logs for POST parameters containing encoded payloads such as %3Cscript%3E or <script
Monitoring Recommendations
- Enable web application firewall (WAF) rules that flag XSS payload patterns submitted to Adobe Commerce form endpoints
- Monitor administrator account activity for anomalous API calls or configuration changes following form page views
- Forward Adobe Commerce application logs to a centralized SIEM for correlation against authentication and session events
How to Mitigate CVE-2025-24410
Immediate Actions Required
- Apply the Adobe security patches referenced in advisory APSB25-08 to all affected Adobe Commerce, Commerce B2B, and Magento Open Source installations
- Invalidate active administrator sessions and rotate API tokens after patching to revoke any potentially hijacked credentials
- Review user-generated content stored in form fields for malicious payloads and sanitize affected records
Patch Information
Adobe released fixed versions addressing CVE-2025-24410 in security bulletin APSB25-08. Administrators must upgrade beyond Adobe Commerce 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, and 2.4.4-p11. Refer to the Adobe Security Advisory for Magento for the complete list of patched versions and upgrade instructions.
Workarounds
- Restrict access to vulnerable form fields to trusted users only until patches are applied
- Deploy a strict Content Security Policy that disallows inline scripts and limits script sources to known origins
- Configure WAF rules to block common XSS payload patterns in POST requests to Adobe Commerce endpoints
- Enforce HttpOnly and Secure attributes on all session cookies to reduce the impact of session theft
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
