cve/2024/CVE-2024-34102.md

CVE-2024-34102

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

POC

Reference

• https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102

Github

• https://github.com/0x0d3ad/CVE-2024-34102
• https://github.com/11whoami99/CVE-2024-34102
• https://github.com/ArturArz1/TestCVE-2024-34102
• https://github.com/Chocapikk/CVE-2024-34102
• https://github.com/Devihtisham01/Anti-skimming-system-for-a-retail-banking-chain
• https://github.com/EQSTLab/CVE-2024-34102
• https://github.com/Kento-Sec/CVE-2024-34102
• https://github.com/Koray123-debug/CVE-2024-34102
• https://github.com/Mr-xn/Penetration_Testing_POC
• https://github.com/Ostorlab/KEV
• https://github.com/Phantom-IN/CVE-2024-34102
• https://github.com/RevoltSecurities/CVE-2024-36401
• https://github.com/SamJUK/cosmicsting-validator
• https://github.com/Santandersecurityresearch/e-Skimming-Detection
• https://github.com/WTN-arny/CVE-2024-37085
• https://github.com/WTN-arny/Vmware-ESXI
• https://github.com/bigb0x/CVE-2024-34102
• https://github.com/bka/magento-cve-2024-34102-exploit-cosmicstring
• https://github.com/bughuntar/CVE-2024-34102
• https://github.com/bughuntar/CVE-2024-34102-Python
• https://github.com/crynomore/CVE-2024-34102
• https://github.com/d0rb/CVE-2024-34102
• https://github.com/dream434/CVE-2024-34102
• https://github.com/dream434/dream434
• https://github.com/f0ur0four/Insecure-Deserialization
• https://github.com/gjportegies/Magento-APSB24-40-Security-Patches
• https://github.com/imooaaz/exploit
• https://github.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento
• https://github.com/m0442/exploit
• https://github.com/mecdotsource/adobecommerce_cosmicsting
• https://github.com/mksundaram69/CVE-2024-34102
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/origamee/gh-advisory-project
• https://github.com/plzheheplztrying/cve_monitor
• https://github.com/redwaysecurity/CVEs
• https://github.com/th3gokul/CVE-2024-34102
• https://github.com/th3gokul/CVE-2024-50603
• https://github.com/unknownzerobit/poc
• https://github.com/wubinworks/magento2-cosmic-sting-patch
• https://github.com/wubinworks/magento2-encryption-key-manager-cli
• https://github.com/wubinworks/magento2-enhanced-xml-security
• https://github.com/wubinworks/magento2-jwt-auth-patch
• https://github.com/wubinworks/magento2-template-filter-patch