russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploitComplete CosmicSting (CVE-2024-34102) exploit suite for Magento/Adobe Commerce XXE vulnerability
Complete exploit suite for CVE-2024-34102 - The CosmicSting XXE vulnerability in Adobe Commerce / Magento 2.4.x.
| Vector | Endpoint |
|---|---|
| Standard XXE | /rest/V1/guest-carts/{id}/estimate-shipping-methods |
| Standard XXE (all) | /rest/all/V1/guest-carts/{id}/estimate-shipping-methods |
| Billing Address | /rest/V1/guest-carts/{id}/billing-address |
| dataIsURL | Same endpoints with dataIsURL: true |
| totalsReader | Alternative JSON structure |
| Orders | /rest/V1/orders, /rest/V1/order |
| Direct path | /app/etc/env.php, /.env, etc. |
app/etc/env.php (database credentials, encryption keys).env (environment variables)/etc/passwd (user enumeration)/etc/hosts (internal network mapping)/proc/self/environ (process environment)app/etc/config.php, app/etc/config.local.phpvar/log/system.log, var/log/exception.logpip install requests
python3 cosmicsting-cve-2024-34102.py https://target.com