Description
Magento是一款开源的电子商务平台，广泛应用于在线商店和电子商务网站。该漏洞存在于接口/rest/all/V1/guest-carts/test-assetnote/estimate-shipping-methods中，攻击者可以通过构造恶意的XML数据触发XXE（XML外部实体）注入漏洞，从而读取服务器上的任意文件或发起外部请求，可能导致敏感信息泄露。
Magento /rest/all/V1/guest-carts/test-assetnote/estimate-shipping-methods XML 外部实体注入漏洞（CVE-2024-34102）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-34102
https://helpx.adobe.com/security/products/magento/apsb24-40.html
https://www.assetnote.io/resources/research/why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102/
https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
https://www.splunk.com/en_us/blog/security/cosmicsting-a-critical-xxe-vulnerability-in-adobe-commerce-and-magento.html
https://github.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento
https://sansec.io/research/cosmicsting
https://www.rapid7.com/db/vulnerabilities/magento-cve-2024-34102/
https://www.tenable.com/cve/CVE-2024-34102