Anti CosmicSting Security

Anti CosmicSting Security extension designed to detect and block malicious content associated with CosmicSting (CVE-2024-34102) and similar cross-site scripting (XSS) injection techniques targeting admin-editable content.

The extension provides an additional layer of protection by scanning supported content before it is saved. Suspicious markup, encoded payloads, and known malicious patterns are detected before the content is persisted. When malicious content is detected, the save operation is blocked and the event is recorded in the security log.

Security scanning is available through three mechanisms:

• Real-time protection : Content is checked at the moment of save, so malicious injections are stopped before they ever reach the database.   
• Scheduled Scanning : Automatically scan existing store content at configurable intervals using Magento cron. This helps detect malicious content that may have been introduced before the extension was installed, through imports, migrations, or other processes outside the normal admin save flow.
• CLI Scanning : Run an on-demand security scan from the command line whenever required, making it useful for manual checks, maintenance, and integration with server-side workflows.

Detected incidents are recorded in a centralized admin security log, providing information such as severity, affected entity, administrator, IP address, matched patterns, decoded payloads, and resolution details. Each incident moves through a clear status lifecycle — Open, Blocked, Resolved, or False Positive — and the extension can automatically send a matching notification email at each key stage: when a scan first detects a threat, when a save is actively blocked in real time, and when an administrator marks an incident resolved. This keeps your team informed the moment something happens, without needing to check the admin panel manually.

This extension is designed as an additional security layer and does not replace keeping Magento, Adobe Commerce, and installed extensions updated with the latest security patches.

Key Features

• Real-time save protection: Scans supported CMS Pages, CMS Blocks, Widget Instances, Products, Categories, and selected design configuration content before it is persisted.
• Malicious content detection: Detects suspicious JavaScript, encoded payloads, URLs, and configured malicious patterns associated with injection attempts.
• Scheduled security scanning: Uses Magento cron to periodically scan existing store content and identify potentially malicious content.
• On-demand CLI scanning: Run security scans manually from the Magento command line or integrate scanning into maintenance and deployment workflows.
• Centralized Admin Security Log: Records detected incidents with severity, entity type, entity information, administrator information, IP address, request URI, matched patterns, decoded URL information, and content hash.
• Incident resolution tracking: Track the status of detected incidents and record resolution notes and administrator information.
• Configurable detection threshold: Configure the detection sensitivity according to the store's security requirements.
• Status-based email workflow: Automatically sends a distinct notification email at each stage of an incidents lifecycle — an alert when a scheduled or CLI scan detects a threat, a real-time notice when a save is actively blocked, and a confirmation when an incident is marked resolved — so your team stays informed without manually checking the security log.
• Dedicated ACL permissions: Control administrator access to security logs and extension configuration through Magento ACL.
• Magento-native architecture: Uses Magento-standard dependency injection, plugins, cron jobs, CLI commands, resource models, and UI components without modifying Magento core files.
• No customer-page scanning: Security scanning is performed during supported save operations and background/CLI scans rather than on normal storefront page loads.
• Defense-in-depth security: Provides an additional security layer for Magento Open Source and does not replace applying Magento security patches and updates.