Kento-Sec

GitHub · Repository owner · Source ID 53268974
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

Kento-Sec/CVE-2024-34102

Repository PoC0Created 2025-08-14ExploitCVE-2024-341024 files

14.8 KiB

GitHubPoC details
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

A Go-based tool named 'Cosmic Sting' that exploits CVE-2024-34102, an XXE vulnerability in Adobe Commerce. It crafts an XML payload to exfiltrate arbitrary files from a target server via an out-of-band SSRF callback, then decodes and prints the file contents.

Backdoor review

Suspicious behavior

The PoC exploits CVE-2024-34102 (XXE) to read files from a target Adobe Commerce server. The exploit exfiltrates the file content through a third-party service (api.cvssadvisor.com) and a public file host (fars.ee) without the operator's configuration or consent. The README documents the tool as reading a file via SSRF, but it does not disclose that the exfiltrated data is routed through these external services, which constitutes a material omission and concealment of data flow.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesGo
Target softwareAdobe Commerce
Attack typesXXEArbitrary File ReadSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by sending a crafted request to trigger XXE, exfiltrating file contents, and presenting them to the user. It does not merely detect or report the vulnerability; it performs the full exploitation chain.

cosmic_sting.go:255-275README.md:1-3

Requirements

  • Target must be running a vulnerable version of Adobe Commerce (2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier).README.md:6
  • Attacker needs a publicly accessible server to host the malicious DTD file, or uses the integrated fars.ee upload and cvssadvisor.com callback services.cosmic_sting.go:56-93cosmic_sting.go:95-119

Observed behavior

  • Creates a malicious DTD file containing an XXE payload that reads a specified file using a PHP filter and exfiltrates it via an HTTP callback.cosmic_sting.go:57-58
  • Uploads the DTD file to fars.ee to obtain a publicly accessible URL.cosmic_sting.go:59-89
  • Sends a crafted JSON POST request to the target's /rest/V1/guest-carts/1/estimate-shipping-methods endpoint containing an inline XML payload that references the hosted DTD.cosmic_sting.go:201-216
  • Polls the cvssadvisor.com SSRF instance log for the exfiltrated data, base64-decodes it, and prints the file contents.cosmic_sting.go:121-159
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed External Data Exfiltration
  • The exploit automatically exfiltrates the target file's content through a hardcoded third-party callback service (api.cvssadvisor.com) and a public file host (fars.ee). The README describes the tool as reading a file via SSRF but does not disclose that the data is sent to these external services, concealing the data flow from the operator.cosmic_sting.go:57-58cosmic_sting.go:59cosmic_sting.go:96-97cosmic_sting.go:121-122README.md:1-68

Observables

Url
Payload withheldHardcoded third-party service used to create an interactive SSRF callback instance for exfiltrating the target file's content.cosmic_sting.go:96-97
Url
Payload withheldHardcoded public file hosting service used to upload the crafted DTD file that triggers the XXE and exfiltration.cosmic_sting.go:59
Domain
Payload withheldHardcoded domain used in the DTD entity to receive the base64-encoded exfiltrated file content.cosmic_sting.go:57-58
Review boundaries

What the analysis did not establish

  • The analysis is based solely on static source code review; the code was not executed, and its effectiveness or safety is not verified.
  • The exploit relies on external services (fars.ee, cvssadvisor.com) that may not be available or may have changed since the code was written.
  • The review does not assess the ownership, reachability, or data handling practices of the external services (api.cvssadvisor.com, fars.ee, payload withheld).
  • The review does not confirm whether the exfiltrated data is actually received or misused by a third party.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

Kento-Sec/GitLab-Graphql-CVE-2020-26413

Repository PoC1Created 2022-06-30Not analyzedCVE-2020-264132 files

3.6 KiB

GitHubPoC details