README

A utility for Magento 2 encryption key rotation and management. CVE-2024-34102(aka Cosmic Sting) victims can use it as an aftercare.

Designed for

• Development usage
• Deployment automation
• CVE-2024-34102(aka Cosmic Sting) aftercare

CVE-2024-34102(aka Cosmic Sting)

After applying security patches, you need to perform a key rotation to completely deny the attacker's Admin level WebAPI access.

If you cannot upgrade or apply the official isolated patch, see Our Patches.

If the official encryption key rotation command php bin/magento encryption:key:change is not available, you can use this extension and this extension has more features as a "Key Manager".

Usage

This extension offers 3 commands.

• Generate new encryption key(for development/scripting purpose)

php bin/magento ww:encryption-key-manager:genkey [-f|--format FORMAT]

Example:

$ php bin/magento ww:encryption-key-manager:genkey
5f81fe506a1025b8ea439fd49c6fa8e3

• List all/newest encryption keys

php bin/magento ww:ekm:list [--newest]

Tip: you can use ekm shorthand for encryption-key-manager.

Example:

$ php bin/magento ww:ekm:list
Encryption key count: 3
39a2f1213e6a942af3cd4f1c2d61528c
fdd862cd41f95e4edaf2636258ce359f
3cd27f0eeae9ffec35681d8aa0faa618

• Encryption key rotation (most important)

php bin/magento ww:encryption-key-manager:rotate [-k|--key KEY]

Tip: if -k|--key is not provided, a random generated key will be used.

Example:

$ php bin/magento ww:encryption-key-manager:rotate
Encryption key has been rotated successfully.
Encryption keys are stored in `app/etc/env.php`. Caution: do not delete old keys!

New Encryption Key Format

Starting from version 2.4.7, encryption key format is changed from hex to base64.

New format example(note it has a base64 prefix):

base64bDr+HSz4tZ+cjZA89J5RvbZzCfDKWO1iXgDfmqeZL0c=

By default, php bin/magento ww:encryption-key-manager:genkey generates a key that is compatible with your current Magento version.

But you can force the format(for development purpose)

php bin/magento ww:encryption-key-manager:genkey --format base64
php bin/magento ww:encryption-key-manager:genkey --format hex

More details of the key generation process are in this blog post.

Requirements

Magento 2.4

Installation

composer require wubinworks/module-encryption-key-manager-cli

♥

If you like this extension please star this repository.

You May Also Like

Magento 2 patch for CVE-2024-34102(aka Cosmic Sting)

Magento 2 JWT Authentication Patch