russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit

# CosmicSting (CVE-2024-34102) Exploit 套件 针对 **CVE-2024-34102** 的完整 Exploit Suite - Adobe Commerce / Magento 2.4.x 中的 CosmicSting XXE 漏洞。 ## 漏洞详情 - **CVE**: CVE-2024-34102 (CVSS 9.8) - **类型**: XML External Entity Injection (XXE) - **影响**: 未授权远程文件读取、SSRF、潜在 RCE - **受影响版本**: Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 及更早版本 ## 已测试的攻击向量 | 向量 | Endpoint | |--------|----------| | 标准 XXE | `/rest/V1/guest-carts/{id}/estimate-shipping-methods` | | 标准 XXE (all) | `/rest/all/V1/guest-carts/{id}/estimate-shipping-methods` | | 账单地址 | `/rest/V1/guest-carts/{id}/billing-address` | | dataIsURL | 相同 endpoint，使用 `dataIsURL: true` | | totalsReader | 替代的 JSON 结构 | | 订单 | `/rest/V1/orders`, `/rest/V1/order` | | 直接路径 | `/app/etc/env.php`, `/.env` 等 | ## 目标文件 - `app/etc/env.php` (数据库凭据、加密密钥) - `.env` (环境变量) - `/etc/passwd` (用户枚举) - `/etc/hosts` (内部网络映射) - `/proc/self/environ` (进程环境) - `app/etc/config.php`, `app/etc/config.local.php` - `var/log/system.log`, `var/log/exception.log` ## 用法 ``` pip install requests python3 cosmicsting-cve-2024-34102.py https://target.com ``` ## 参考 - [AssetNote 研究](https://www.assetnote.io/resources/research/why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102) - [Sansec CosmicSting](https://sansec.io/research/cosmicsting) - [SamJUK/cosmicsting-validator](https://github.com/SamJUK/cosmicsting-validator) - [EQSTLab/CVE-2024-34102](https://github.com/EQSTLab/CVE-2024-34102) - [th3gokul/CVE-2024-34102](https://github.com/th3gokul/CVE-2024-34102) - [Nuclei 模板](https://github.com/projectdiscovery/nuclei-templates) - [Ambionics CNEXT + CosmicSting RCE](https://github.com/ambionics/cnext-exploits) - [SpaceWasp 文章](https://github.com/spacewasp/public_docs)

标签：Magento, XXE, 安全, 安全助手, 超时处理, 逆向工具