https://github.com/samjuk/cosmicsting-validator
CosmicSting (CVE-2024-34102) POC / Patch Validator
https://github.com/samjuk/cosmicsting-validator
cosmicsting cve-2024-34102 devsecops magento magento-security-patches poc proof-of-concept security
Last synced: 4 months ago
JSON representation
CosmicSting (CVE-2024-34102) POC / Patch Validator
- Host: GitHub
- URL: https://github.com/samjuk/cosmicsting-validator
- Owner: SamJUK
- Created: 2024-07-07T23:35:18.000Z (about 1 year ago)
- Default Branch: master
- Last Pushed: 2025-02-14T17:37:41.000Z (5 months ago)
- Last Synced: 2025-02-14T18:30:59.617Z (5 months ago)
- Topics: cosmicsting, cve-2024-34102, devsecops, magento, magento-security-patches, poc, proof-of-concept, security
- Language: Python
- Homepage: https://cosmicsting.samdjames.uk/
- Size: 4.88 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
A [Cosmicsting POC](https://github.com/Chocapikk/CVE-2024-34102), with a bash script to check all of our hosted sites to confirm the patch.
This repository is provided to allow store owners / hosts to confirm the patch is applied on stores. Within `check.bash` add domains to the `SITES` list.
[https://www.sdj.pw/posts/magento2-cosmic-sting-check/](https://www.sdj.pw/posts/magento2-cosmic-sting-check/)
[Online Validator https://cosmicsting.samdjames.uk/](https://cosmicsting.samdjames.uk/)
## Setup
```sh
# Create a python virtual environment for the project
python -m venv venv
# Activate virtual environment (pick appropriate below)
source venv/bin/activate # MacOS / Unix
venv\Scripts\activate # Windows
# Install Requirements
pip install -r requirements.txt
```
## Usage
```sh
# Run the POC against a single store
./poc.py -u https://samdjames.uk
# To run the POC against multiple stores, first create txt file containing the list of sites seperated by a new line
# for example `sites/example.txt`. And pass it as the first positional argument of the ./z_validate script.
./z_validate sites/example.txt
# A very basic check monitoring stores for compromise
# Dumps all script src's to a file, and compares against the previous run.
./z_compromise_check sites/example.txt
```