CVE-2024-34102 PoC — XXE can expose crypt key and other secrets granting full admin access

Source

https://github.com/bka/magento-cve-2024-34102-exploit-cosmicstring

Associated Vulnerability

Title:XXE can expose crypt key and other secrets granting full admin access (CVE-2024-34102)
Description:Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Readme

# CVE 2024-34102 - CosmicSting XXE Vulnerability in Adobe Commerce & Magento - Educational Material

This repository contains slides and demo material for my talk on the latest **XML External Entity (XXE) vulnerability** in **Adobe Commerce** and **Magento**. The purpose of these materials is purely educational, designed to inform developers, security professionals, and e-commerce stakeholders about this vulnerability, its potential impact, and how to safeguard against it.

## Contents

- **Slides**: An overview of the vulnerability and how it works
- **XXE demo**: Demonstration how XEE work in general
- **Exploit Demo**: Demonstration of how the vulnerability can be exploited

## Disclaimer

This material is provided for **educational purposes only**. I am **not liable** for any damages resulting from the use or misuse of the information provided here. The techniques discussed and demonstrated should only be used in controlled environments for educational or ethical security research purposes.

File Snapshot


 [4.0K]  /data/pocs/99cf9ab911ebdf314875d807147e79fb88472cba
├── [4.0K]  cve-2024-34102-exploit
│   ├── [ 177]  dtd.xml
│   ├── [3.0K]  jwt-builder.php
│   ├── [ 359]  payload.json
│   ├── [1.0K]  README.md
│   └── [ 540]  server.php
├── [4.0K]  images
│   ├── [ 32K]  api-auth.png
│   ├── [162K]  APSB24-40.png
│   ├── [ 38K]  dtdvalid-const.png
│   ├── [ 22K]  dtdvalid-doc.png
│   ├── [228K]  env-extracted.png
│   ├── [ 78K]  patch.png
│   ├── [ 18K]  payload.png
│   ├── [103K]  swagger.png
│   ├── [ 73K]  xxe.drawio.png
│   └── [ 92K]  xxe-uml2.drawio.png
├── [1010]  README.md
├── [1.1K]  slides.md
├── [  46]  start.sh
└── [4.0K]  xxe-demo
    ├── [ 146]  payload.xml
    ├── [ 129]  README.md
    ├── [4.0K]  server
    │   ├── [ 166]  dtd.xml
    │   └── [ 471]  router.php
    └── [ 178]  xml.php

4 directories, 23 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!