包简介

Fix the JWT authentication vulnerability on certain Magento 2 versions. Deny tokens issued by old encryption key. If you cannot upgrade Magento or cannot apply the official patch, try this one.

README 文档

README

Fix the JWT authentication vulnerability on certain Magento 2 versions. Deny tokens issued by old encryption key. If you cannot upgrade Magento or cannot apply the official patch, try this one.

Background

In September 2024, an authentication vulnerability was revealed on multiple Magento versions and those versions are identified that a new module Magento_JwtUserToken is employed.

Tokens(especially Admin Tokens) issued by old encryption key remains valid even if a new key is added. The vulnerability is caused by a bug in the above mentioned module. Attacker who once obtained a key can have persistent Admin level WebAPI access to the victim's store.

CVE-2024-34102(aka Cosmic Sting) Secondary Disaster

By exploiting CVE-2024-34102, the attacker can steal the encryption key and craft "valid" Admin Token.
A key rotation without fixing this vulnerability cannot deny the attacker's Admin level access.

Do I really need this patch ?

If your store is already hacked or you are unsure if it is, then you should assume the encryption key is leaked. Performing an encryption key rotation is very urgent.

Rotate Encryption Key

Note1: Perform the key rotation after installing this patch(extension).
Note2: Encryption keys are stored in app/etc/env.php crypt/key path, but do not delete old keys after rotation.

Login to Admin Panel
Go to System > Other Settings > Manage Encryption Key
Change Auto-generate a Key to Yes and then Change Encryption Key

More details, including command line methods, are in this blog post.

We also developed a tool for deployment automation purpose. Check Magento 2 Encryption Key Manager CLI.

Requirements

For affected versions only

2.4.4 ~ 2.4.4-p9
2.4.5 ~ 2.4.5-p8
2.4.6 ~ 2.4.6-p6
2.4.7 ~ 2.4.7-p1

Compatibility

This extension does not use preference.

Installation

composer require wubinworks/module-jwt-auth-patch

♥

If you like this extension please star this repository.

wubinworks/module-jwt-auth-patch 适用场景与选型建议

wubinworks/module-jwt-auth-patch 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 4 次下载、GitHub Stars 达 3，最近一次更新时间为 2024 年 12 月 10 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「Authentication」「webapi」「token」「jwt」「patch」「magento 2」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 wubinworks/module-jwt-auth-patch 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 wubinworks/module-jwt-auth-patch 我们能提供哪些服务？

定制开发 / 二次开发

基于 wubinworks/module-jwt-auth-patch 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发

与 wubinworks/module-jwt-auth-patch 相关的其它包

同方向 / 同关键字的高下载量 PHP Composer 包推荐，方便对比选型：

rakuten-ws/rws-php-sdk 90

The SDK of Rakuten Web Service

mediawiki/auth-remoteuser 7

Automatically logs-in users if they are already authenticated by a remote source. (e.g. environment variable REMOTE_USER)

fivelab/resource-bundle 2

Add the resource system to symfony application

jamesedmonston/graphql-authentication 29

GraphQL authentication for your headless Craft CMS applications.

tradecoverexchange/google-cloud-jwt-validator 0

A package for validating Google Cloud's JWT provided by webhooks

ad-mos/laravel-jwt-auth 0

JSON Web Token Authentication for Laravel and Lumen

wubinworks/module-jwt-auth-patch

包简介

关键字：