{"uuid": "7cb239e0-a7f2-4808-a603-485402173b5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-2961", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Sergey Temnikov\", \"Charles Fol\", \"Heyder\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This combination of an Arbitrary File Read (CVE-2024-34102) and a Buffer Overflow in glibc (CVE-2024-2961)\\n          allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and\\n          earlier if the PHP and glibc versions are also vulnerable:\\n          - 2.4.7 and earlier\\n          - 2.4.6-p5 and earlier\\n          - 2.4.5-p7 and earlier\\n          - 2.4.4-p8 and earlier\\n\\n          Vulnerable PHP versions:\\n          - From PHP 7.0.0 (2015) to 8.3.7 (2024)\\n\\n          Vulnerable iconv() function in the GNU C Library:\\n          - 2.39 and earlier\\n\\n          The exploit chain is quite interesting and for more detailed information check out the references. The tl;dr being:\\n          CVE-2024-34102 is an XML External Entity vulnerability leveraging  PHP filters to read arbitrary files from the target\\n          system. The exploit chain uses this to read /proc/self/maps, providing the address of PHP's heap and the libc's filename.\\n          The libc is then downloaded, and the offsets of libc_malloc, libc_system and libc_realloc are extracted, and made use\\n          of later in the chain.\\n\\n          With this information and expert knowledge of PHP's heap (chunks, free lists, buckets, bucket brigades), CVE-2024-2961\\n          can be exploited. A long chain of PHP filters is constructed and sent in the same way the XXE is exploited, building a\\n          payload in memory and using the buffer overflow to execute it, resulting in an unauthenticated RCE.\", \"disclosure_date\": \"2024-07-26\", \"fullname\": \"exploit/linux/http/magento_xxe_to_glibc_buf_overflow\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/magento_xxe_to_glibc_buf_overflow\", \"references\": [\"URL-https://github.com/spacewasp/public_docs/blob/main/CVE-2024-34102.md\", \"URL-https://sansec.io/research/cosmicsting\", \"URL-https://www.ambionics.io/blog/iconv-cve-2024-2961-p1\", \"URL-https://github.com/ambionics/cnext-exploits/blob/main/cosmicsting-cnext-exploit.py\", \"CVE-2024-2961\", \"CVE-2024-34102\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:43.932765Z"}