Sploitus

Exploit for CVE-2024-21534

githubexploit · 2024-11-23

Exploit Code

README18 lines
## https://sploitus.com/exploit?id=B7765299-6717-5219-BD88-650BBD154A73
# Vulnerability Information: CVE-2024-21534  
The `jsonpath-plus` package (versions <= 10.0.7) contains a serious remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code through Node.js’s VM module. This vulnerability arises due to lax input validation; affected versions include those below 10.0.7. The **CVSS score** is 9.8 (extremely critical). The vulnerability was first disclosed on October 11, 2024.  

### Vulnerability Details  
Although attempts were made to fix this issue in version 10.0.0, the vulnerability can still be exploited through specific attack vectors (see [Issue #226](https://github.com/JSONPath-Plus/JSONPath/issues/226)).  

### How to Reproduce the Attack  
### Preparation Steps  
1. Install Docker.  
2. Clone this vulnerability validation repository:  
   ```bash
   git clone https://github.com/your-username/CVE-2024-XXXX-PoC.git
   cd CVE-2024-XXXX-PoC
   ```  

### Note  
Special thanks to Andrea Angelo Raineri for discovering and reporting this vulnerability, as well as for assisting in verifying the available attack vectors.