CVE-2025-24428 Overview
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they view the page containing the injected field. The flaw also affects Adobe Commerce B2B and the open-source Magento product line. Adobe published the fix in Security Bulletin APSB25-08.
Critical Impact
Authenticated attackers with low privileges can persist JavaScript in Adobe Commerce storefronts or admin views, hijacking sessions, exfiltrating data, or performing actions in the context of higher-privileged users.
Affected Products
- Adobe Commerce (versions 2.4.4 through 2.4.4-p11, 2.4.5 through 2.4.5-p10, 2.4.6 through 2.4.6-p8, 2.4.7 through 2.4.7-p3, and 2.4.8-beta1)
- Adobe Commerce B2B (versions 1.3.3 through 1.5.0)
- Adobe Magento Open Source (matching Commerce version ranges above)
Discovery Timeline
- 2025-02-11 - CVE-2025-24428 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24428
Vulnerability Analysis
The vulnerability is a stored XSS flaw classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. Adobe Commerce fails to sanitize or encode user-supplied input written into specific form fields. The tainted content persists in the application datastore and is later rendered inside HTML output without proper escaping.
Exploitation requires an authenticated account with low privileges and user interaction from the victim. The attack scope is changed, meaning a successful payload can affect resources beyond the vulnerable component's security context. This is common for admin-to-storefront or user-to-admin XSS chains in e-commerce platforms.
Successful exploitation allows attackers to steal session cookies, redirect victims to attacker-controlled infrastructure, modify displayed content, or invoke administrative API calls if a privileged user renders the injected field.
Root Cause
The root cause is missing output encoding on data that originates from user-controlled form fields. Input written by low-privileged users is stored server-side and later inserted into rendered HTML templates without contextual escaping. Any browser that loads the affected page interprets the injected <script> payload or event-handler attribute as executable code.
Attack Vector
The attack vector is network-based over HTTP or HTTPS. An attacker authenticates to the Commerce application as a low-privileged user, submits a payload into a vulnerable form field, and waits for another user to view the page containing that field. Because the scope changes on execution, an admin viewing the injected data can have their session context abused by the attacker's script.
No verified public exploit code has been released for CVE-2025-24428. See the Adobe Security Bulletin APSB25-08 for vendor-provided technical details.
// No verified proof-of-concept code is publicly available.
// Refer to Adobe Security Bulletin APSB25-08 for vendor details.
Detection Methods for CVE-2025-24428
Indicators of Compromise
- Form field values in the Commerce database containing <script>, javascript:, onerror=, onload=, or other HTML event-handler attributes.
- Outbound HTTP requests from admin or customer browsers to unfamiliar domains shortly after loading Commerce pages.
- Unexpected admin actions or API calls originating from valid admin sessions without corresponding user activity.
Detection Strategies
- Review web server access logs for POST requests to form endpoints containing encoded script tags or suspicious character sequences.
- Query the Commerce database for stored fields containing HTML control characters that should have been sanitized on input.
- Correlate admin session activity with browser telemetry to identify script execution not initiated by the user.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting and monitor report-uri endpoints for violations on Commerce admin and storefront pages.
- Alert on new low-privileged admin accounts submitting content to fields historically restricted to trusted roles.
- Monitor for repeated failed CSP directives that indicate active injection attempts against rendered pages.
How to Mitigate CVE-2025-24428
Immediate Actions Required
- Apply the patches referenced in Adobe Security Bulletin APSB25-08 to all Adobe Commerce, Commerce B2B, and Magento Open Source deployments.
- Audit existing low-privileged admin and customer accounts for anomalous form submissions since February 2025.
- Rotate admin session tokens and force re-authentication for privileged users after patching.
Patch Information
Adobe released fixes in Security Bulletin APSB25-08. Upgrade to versions later than 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, and 2.4.4-p11 as documented in the advisory. Commerce B2B installations must be updated in tandem with the base Commerce platform.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Restrict access to affected form fields to trusted administrator roles until patching completes.
- Deploy a web application firewall rule to block requests containing HTML tags or JavaScript event handlers in body parameters targeted by the vulnerability.
# Example CSP header to reduce stored XSS impact on Commerce pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.