Jakaba01

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions 2.4.4-p8 and earlier Adobe Commerce versions 2.4.5-p7 and earlier Adobe Commerce versions 2.4.6-p5 and earlier Adobe Commerce versions 2.4.7 and earlier **Description** Adobe Commerce and Magento Open Source are affected by an Improper Restriction of XML External Entity Reference ('XXE') issue. This flaw could allow a remote attacker to execute arbitrary code by sending a specially crafted XML document referencing external entities. The vulnerability is actively exploited, with reports indicating over 4,000 stores compromised and ongoing attacks. Multiple threat actors are leveraging this vulnerability to inject malicious scripts. The vulnerability, dubbed "CosmicSting", allows attackers to steal sensitive data, including cryptographic keys, potentially leading to further compromise. The `/rest/V1/guest-carts/1/estimate-shipping-methods` **API Endpoint** is a potential target, with the `data` **variable** within the `sourceData` section being susceptible to manipulation. Exploitation does not require user interaction. **Recommendations** Adobe Commerce versions prior to 2.4.7 should be updated. Adobe Commerce versions prior to 2.4.6-p5 should be updated. Adobe Commerce versions prior to 2.4.5-p7 should be updated. Adobe Commerce versions prior to 2.4.4-p8 should be updated.

**Name of the Vulnerable Software and Affected Versions** Anyscale Ray versions 2.6.3 and 2.8.0 Anyscale Ray versions prior to 2.52.0 **Description** Anyscale Ray contains a flaw due to insufficient validation of incoming requests and missing authentication for critical functions. This allows an unauthenticated remote attacker to execute arbitrary code via the job submission API and the Ray dashboard web interface. Approximately 230,000 Ray servers are exposed online, making them targets for the ShadowRay 2.0 campaign. In this campaign, threat actors hijack NVIDIA GPU clusters to create a self-propagating, worm-like botnet used for cryptocurrency mining, distributed denial-of-service (DDoS) attacks, and data theft, including the theft of production database credentials, environment variables, and AI models. The attack typically involves initial access via exposed Ray dashboard ports (default 8265). **Recommendations** For versions 2.6.3 and 2.8.0, restrict network access to the Ray dashboard (port 8265) to trusted internal IPs only and ensure it is not exposed to the internet. For versions prior to 2.52.0, enable token authentication to secure the environment. Isolate dashboard endpoints and restrict API access to prevent unauthorized use of the job submission API. Monitor network logs for unauthorized access to the Ray dashboard endpoint and anomalous command execution.