Jakaba01

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions 2.4.4-p8 and earlier Adobe Commerce versions 2.4.5-p7 and earlier Adobe Commerce versions 2.4.6-p5 and earlier Adobe Commerce versions 2.4.7 and earlier **Description** Adobe Commerce and Magento Open Source are affected by an Improper Restriction of XML External Entity Reference ('XXE') issue. This flaw could allow a remote attacker to execute arbitrary code by sending a specially crafted XML document referencing external entities. The vulnerability is actively exploited, with reports indicating over 4,000 stores compromised and ongoing attacks. Multiple threat actors are leveraging this vulnerability to inject malicious scripts. The vulnerability, dubbed "CosmicSting", allows attackers to steal sensitive data, including cryptographic keys, potentially leading to further compromise. The `/rest/V1/guest-carts/1/estimate-shipping-methods` **API Endpoint** is a potential target, with the `data` **variable** within the `sourceData` section being susceptible to manipulation. Exploitation does not require user interaction. **Recommendations** Adobe Commerce versions prior to 2.4.7 should be updated. Adobe Commerce versions prior to 2.4.6-p5 should be updated. Adobe Commerce versions prior to 2.4.5-p7 should be updated. Adobe Commerce versions prior to 2.4.4-p8 should be updated.

**Name of the Vulnerable Software and Affected Versions** Anyscale Ray versions 2.6.3 through 2.8.0 **Description** Anyscale Ray versions 2.6.3 and 2.8.0 contain a remote code execution issue due to insufficient validation of incoming requests through the job submission API. Attackers can exploit this to execute arbitrary code on compromised systems. The vendor states the report is irrelevant as Ray is not intended for use outside of a strictly controlled network environment. This vulnerability, dubbed ShadowRay, has been actively exploited in campaigns to compromise AI compute clusters and create a self-propagating botnet. The campaign has impacted numerous organizations, with over 230,000 Ray servers exposed. Attackers leverage the vulnerability to deploy malicious Python payloads for resource optimization, establishing reverse shells for command and control, and implementing persistence mechanisms. The exploitation focuses on GPU resources for cryptocurrency mining and utilizes a self-propagating model to amplify exploitation and extract sensitive data. The vulnerability allows attackers to submit jobs via the `/api/v1/jobs` API endpoint without authentication. **Recommendations** For Anyscale Ray versions 2.6.3 and 2.8.0, isolate dashboard endpoints, enable authentication, restrict API access, and scan for use of the Jobs API from untrusted sources.