CVE-2025-24414: Adobe Commerce Stored XSS Vulnerability

CVE-2025-24414 Overview

CVE-2025-24414 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw resides in form fields that fail to properly sanitize user-supplied input before storing and rendering it. A low-privileged authenticated attacker can inject malicious JavaScript that executes in a victim's browser when the affected page is rendered. Successful exploitation leads to session takeover, account compromise, and unauthorized actions performed in the victim's context. The vulnerability is tracked under CWE-79 and was patched in Adobe Security Bulletin APSB25-08.

Critical Impact
Authenticated attackers can hijack administrator or customer sessions through stored JavaScript payloads, compromising the confidentiality and integrity of Adobe Commerce storefronts and back-office portals.

Affected Products

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
Adobe Commerce B2B versions 1.5.0, 1.4.2-p3, 1.3.5-p8, 1.3.4-p10, 1.3.3-p11 and earlier
Magento Open Source equivalents through 2.4.8-beta1

Discovery Timeline

2025-02-11 - CVE-2025-24414 published to the National Vulnerability Database
2025-04-16 - Last updated in NVD database

Technical Details for CVE-2025-24414

Vulnerability Analysis

The vulnerability is a stored XSS issue in Adobe Commerce form fields. When a low-privileged authenticated user submits crafted input containing JavaScript, the application persists the payload without adequate output encoding. The script later executes whenever a victim, including administrators or other users, loads a page that renders the stored field.

Because the attack requires only low privileges and a single user interaction to view the affected page, it scales well against multi-tenant Commerce deployments. The scope-changed CVSS rating reflects that the injected script runs in the victim's browser context, crossing the trust boundary of the original injection point.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79. The affected form handlers accept HTML or script characters such as <, >, and quote markers without applying contextual escaping when rendering the stored values back into the DOM.

Attack Vector

An attacker with a low-privileged Commerce account submits a payload such as an <img> tag with an onerror handler or a <script> element into a vulnerable form field. The payload is stored in the Commerce database. When a higher-privileged user, such as a store administrator, views the storefront page or admin grid that renders the value, the browser executes the script. The attacker can then exfiltrate session cookies, perform CSRF-style actions, or pivot to administrative functions.

No verified public proof-of-concept is available. Refer to the Adobe Magento Security Advisory APSB25-08 for vendor-confirmed technical details.

Detection Methods for CVE-2025-24414

Indicators of Compromise

Unexpected <script>, <svg>, <img onerror=...>, or javascript: strings stored in Commerce database tables tied to customer attributes, product attributes, or B2B form data
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing Commerce admin pages
New or modified admin accounts created without a corresponding authenticated session from a known operator
Session cookies (admin, PHPSESSID) appearing in web server access logs from unexpected IP addresses

Detection Strategies

Scan database fields and entity attribute tables for HTML or script tokens using a query against catalog_product_entity_*, customer_entity_*, and B2B-related tables
Deploy Content Security Policy (CSP) reporting and review violations for inline script execution attempts in admin and storefront contexts
Inspect web application firewall (WAF) logs for POST requests containing encoded <script> or onerror= patterns to form endpoints

Monitoring Recommendations

Enable detailed access logging on /admin and form-submission endpoints, then correlate with downstream administrator activity
Monitor for anomalous administrator session reuse from multiple IP addresses or geolocations
Alert on creation of new admin users, role changes, or API token issuance immediately following a stored field update

How to Mitigate CVE-2025-24414

Immediate Actions Required

Apply the security updates referenced in Adobe Security Bulletin APSB25-08 to upgrade Commerce, Commerce B2B, and Magento Open Source to the patched releases
Audit existing form-field content for stored JavaScript payloads and remove any malicious entries before users render the affected pages
Rotate administrator credentials and invalidate active sessions following patch deployment to neutralize any captured cookies

Patch Information

Adobe released fixed versions on the schedule documented in APSB25-08. Upgrade to Adobe Commerce 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, or the corresponding Magento Open Source releases. Adobe Commerce B2B installations must be upgraded to the matching B2B patch level. Review the vendor advisory for the complete version matrix.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit payload execution
Restrict low-privileged account creation and require manual review of new B2B or customer registrations until patching completes
Place a WAF rule in front of Commerce form endpoints to block payloads containing <script, onerror=, onload=, and javascript: schemes

bash

# Example: upgrade Adobe Commerce via Composer to a patched release
composer require magento/product-community-edition=2.4.7-p4 --no-update
composer update
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush