1
2name: crowdsecurity/vpatch-CVE-2024-34102
3description: "Adobe Commerce & Magento - XXE (CVE-2024-34102)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      transform:
9      - uppercase
10      match:
11        type: equals
12        value: POST
13    - zones:
14      - URI
15      transform:
16      - lowercase
17      match:
18        type: contains
19        value: /rest/v1/guest-carts/1/estimate-shipping-methods
20    - zones:
21      - BODY_ARGS
22      variables:
23      - json.address.totalsCollector.collectorList.totalCollector.sourceData.data
24      transform:
25        - lowercase
26      match:
27        type: contains
28        value: "<!entity"
29  - and:
30    - zones:
31      - METHOD
32      transform:
33      - lowercase
34      match:
35        type: equals
36        value: post
37    - zones:
38      - URI
39      transform:
40      - lowercase
41      match:
42        type: contains
43        value: /rest/v1/guest-carts/1/estimate-shipping-methods
44    - zones:
45      - BODY_ARGS
46      variables:
47      - json.address.totalsCollector.collectorList.totalCollector.sourceData.data
48      transform:
49        - lowercase
50      match:
51        type: contains
52        value: "://"
53    - zones:
54      - BODY_ARGS
55      variables:
56      - json.address.totalsCollector.collectorList.totalCollector.sourceData.dataIsURL
57      transform:
58        - lowercase
59      match:
60        type: equals
61        value: "true"
62
63
64labels:
65  type: exploit
66  service: http
67  confidence: 3
68  spoofable: 0
69  behavior: "http:exploit"
70  label: "Adobe Commerce & Magento - XXE"
71  classification:
72   - cve.CVE-2024-34102
73   - attack.T1595
74   - attack.T1190
75   - cwe.CWE-611