目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2024-28397— Js2Py 安全漏洞

一分钟漏洞结论

影响对象
n/a n/a
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Js2Py是Python基金会的一个库。用于将 JavaScript 转换为 Python 代码。 Js2Py 0.74 及之前版本存在安全漏洞，该漏洞源于组件 js2py.disable_pyimport() 中存在一个问题，攻击者利用该漏洞可以通过精心设计的 API 调用执行任意代码。

AI 预测 9.8 利用难度: 较易 EPSS 4.55% · P91
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2024-28397 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
N/A
来源: CVE Program / CVE List V5
Vulnerability Description
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Js2Py 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Js2Py是Python基金会的一个库。用于将 JavaScript 转换为 Python 代码。 Js2Py 0.74 及之前版本存在安全漏洞，该漏洞源于组件 js2py.disable_pyimport() 中存在一个问题，攻击者利用该漏洞可以通过精心设计的 API 调用执行任意代码。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
- n/a n/a -

二、漏洞 CVE-2024-28397 的公开POC

# POC 描述 源链接 神龙链接
1 to be released https://github.com/Marven11/CVE-2024-28397 POC详情
2 CVE-2024-28397: js2py sandbox escape, bypass pyimport restriction. https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape POC详情
3 None https://github.com/CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape POC详情
4 An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28397.yaml POC详情
5 This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. https://github.com/waleed-hassan569/CVE-2024-28397-command-execution-poc POC详情
6 The CVE-2024-28397 vulnerability affects versions of js2py up to v0.74, a Python library that allows JavaScript code to be executed within the Python interpreter. https://github.com/0timeday/exploit-js2py POC详情
7 None https://github.com/harutomo-jp/CVE-2024-28397-RCE POC详情
8 None https://github.com/Naved124/CVE-2024-28397-js2py-Sandbox-Escape POC详情
9 The CVE-2024-28397 vulnerability affects versions of js2py up to v0.74, a Python library that allows JavaScript code to be executed within the Python interpreter. https://github.com/releaseown/exploit-js2py POC详情
10 PoC exploit for CVE-2024-28397 – Remote Code Execution in pyload-ng via js2py sandbox escape https://github.com/ExtremeUday/Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py- POC详情
11 This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB). https://github.com/naclapor/CVE-2024-28397 POC详情
12 None https://github.com/0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE POC详情
13 This repository contains a Proof of Concept (PoC) for CVE-2024-28397, a vulnerability in the js2py library allowing a sandbox escape to achieve remote code execution. https://github.com/nelissandro/CVE-2024-28397-Js2Py-RCE POC详情
14 CVE-2024-28397 - Remote Code Execution From Vulnerable JS2PY https://github.com/vitaciminIPI/CVE-2024-28397-RCE POC详情
15 This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. https://github.com/Ghost-Overflow/CVE-2024-28397-command-execution-poc POC详情
16 Reverse shell for CVE-2024-28397. https://github.com/0xPadme/CVE-2024-28397-Reverse-Shell POC详情
17 This repository contains a Proof of Concept (PoC) for CVE-2024-28397, a vulnerability in the js2py library allowing a sandbox escape to achieve remote code execution. https://github.com/D3ltaFormation/CVE-2024-28397-Js2Py-RCE POC详情
18 A Python automation script for exploiting the **js2py Sandbox Escape** vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery process to achieve Remote Code Execution (RCE) on vulnerable instances. https://github.com/L1337Xi/CVE-2024-28397-Exploit-Automation POC详情
19 This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. https://github.com/GhostOverflow/CVE-2024-28397-command-execution-poc POC详情
20 js2py <= 0.74 sandbox escape (CVE-2024-28397) https://github.com/3z-p0wn/CVE-2024-28397-exploit POC详情
21 Professional exploit for CVE-2024-28397: Js2Py Sandbox Escape leading to Remote Code Execution (RCE). Includes modular payload generation. https://github.com/xeloxa/CVE-2024-28397-Js2Py-RCE-Exploit POC详情
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2024-28397 的情报信息

请登录查看更多情报信息。

CVE-2024-28397 其他参考 (2)

同批安全公告 · n/a · 2024-06-20 · 共 13 条

CVE-2024-36071 6.3 MEDIUM SAMSUNG Magician PC Software 安全漏洞
CVE-2024-30848 SilverSky E-mail 跨站脚本漏洞
CVE-2024-31586 Computer Laboratory Management System 跨站脚本漏洞
CVE-2024-37674 Moodle CMS 跨站脚本漏洞
CVE-2024-37626 TOTOLINK A6000R 安全漏洞
CVE-2024-37676 htop 安全漏洞
CVE-2024-37818 Strapi 安全漏洞
CVE-2024-37699 DataLife Engine SQL注入漏洞
CVE-2024-29390 PHPGurukul Daily Expenses Management System 安全漏洞
CVE-2024-33335 H3C SeaSQL DWS SQL注入漏洞
CVE-2022-45929 Northern.tech Mender 安全漏洞
CVE-2022-41324 Northern.tech Mender 安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2024-28397

暂无评论

发表评论