CVE-2025-24413 Overview
CVE-2025-24413 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they view the affected page. Successful exploitation can lead to session takeover, exposing both confidentiality and integrity of user accounts. The vulnerability is tracked under [CWE-79] and is addressed in Adobe Security Bulletin APSB25-08.
Critical Impact
Authenticated attackers can persist malicious scripts that hijack administrator or customer sessions, enabling account compromise on affected Adobe Commerce storefronts.
Affected Products
- Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
- Adobe Commerce B2B versions 1.5.0, 1.4.2-p3, 1.3.5-p8, 1.3.4-p10, 1.3.3-p11 and earlier
- Magento Open Source versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
Discovery Timeline
- 2025-02-11 - CVE-2025-24413 published to NVD
- 2025-04-16 - Last updated in NVD database
Technical Details for CVE-2025-24413
Vulnerability Analysis
The vulnerability is a stored XSS flaw in Adobe Commerce form-field handling. Form input fields fail to properly neutralize user-supplied data before storing and rendering it in subsequent pages. When a victim views a page containing the tainted field, the injected JavaScript executes in their browser context.
Because the attack crosses a security scope, scripts injected by a low-privileged user can affect higher-privileged users such as administrators. The result is high confidentiality and integrity impact through session takeover, while availability remains unaffected. The flaw requires user interaction, meaning the victim must navigate to the page rendering the malicious payload.
Root Cause
The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. Affected form fields do not sufficiently encode or sanitize user-supplied content before persisting it to the database and serving it back to other users. Output rendering paths likewise omit context-aware escaping, allowing HTML and JavaScript tokens to be interpreted by the browser.
Attack Vector
An authenticated attacker with low privileges submits a crafted payload containing JavaScript into a vulnerable form field. The application stores the payload without adequate sanitization. When another user, including a privileged administrator, loads the page that renders the stored data, the script runs under that user's session. The attacker can then exfiltrate session cookies, perform actions on behalf of the victim, or pivot to further account compromise.
No verified public proof-of-concept code is available for this vulnerability. Refer to the Adobe Magento Security Advisory APSB25-08 for vendor technical details.
Detection Methods for CVE-2025-24413
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) stored in Adobe Commerce database fields such as product attributes, customer data, or CMS blocks.
- Outbound HTTP requests from admin or customer sessions to unfamiliar domains shortly after rendering catalog or account pages.
- Anomalous administrator session activity, including unexpected configuration changes or new admin user creation following normal page navigation.
Detection Strategies
- Review web server access logs for POST requests to Adobe Commerce form endpoints containing encoded script payloads or HTML entities in parameter values.
- Inspect stored content in catalog_product_entity_varchar, customer attribute tables, and CMS tables for script tags or suspicious JavaScript expressions.
- Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports for script-src breaches originating from form-rendered pages.
Monitoring Recommendations
- Enable application-level audit logging for admin panel activity and customer profile modifications.
- Monitor admin session cookies for use from unexpected IP addresses or user agents, indicating possible session theft.
- Integrate Adobe Commerce logs into a centralized SIEM to correlate form submissions with subsequent privileged actions.
How to Mitigate CVE-2025-24413
Immediate Actions Required
- Apply the Adobe security patches referenced in APSB25-08 to all affected Adobe Commerce, Commerce B2B, and Magento Open Source installations.
- Audit existing form-field data and CMS content for previously injected payloads, sanitizing or removing any malicious entries.
- Rotate administrator credentials and invalidate active admin sessions after patching to mitigate any pre-existing session compromise.
Patch Information
Adobe released fixed versions on February 11, 2025. Upgrade to Adobe Commerce 2.4.8, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, or 2.4.4-p12 and equivalent Magento Open Source releases. Adobe Commerce B2B should be upgraded to the corresponding patched releases. Full upgrade guidance is published in the Adobe Magento Security Advisory APSB25-08.
Workarounds
- Restrict administrative access to trusted IP ranges via the web server or WAF until patches are applied.
- Deploy a strict Content Security Policy that disallows inline scripts and limits script sources to known domains.
- Apply WAF rules to block requests containing script tags, javascript: URIs, and common XSS payload patterns targeting Adobe Commerce form endpoints.
# Configuration example: example CSP header to limit script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
