⬇ Download holy card: ·
Saint CosmicSting, the Sting That Emptied the Shops
Patron of online shops, XML external entities, and catalogues that read more than they should.
Life
In June 2024 Sansec revealed an XXE in Adobe Commerce and Magento (CVE-2024-34102): a crafted document made the shop read files off the server, secret keys included, and chained to an old glibc flaw it reached code execution. Thousands of stores were hacked before everyone patched, and the bug landed in CISA's catalogue of exploited vulnerabilities.
Prayer
O Saint CosmicSting, who stings shops from the heaven of external entities, teach our parsers not to go fetching distant files. Amen.
How to celebrate
Celebrated by applying Adobe's patch, rotating the shop's encryption key and checking you have not already had visitors.
A shop that reads too much makes the customer pay double.