CVE-2024-28397
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Js2Py是Python基金会的一个库。用于将 JavaScript 转换为 Python 代码。 Js2Py 0.74 及之前版本存在安全漏洞，该漏洞源于组件 js2py.disable_pyimport() 中存在一个问题，攻击者利用该漏洞可以通过精心设计的 API 调用执行任意代码。
Public Exploits 3
ExploitDB · 1
EDB-52532 [webapps]
Metasploit · 1
pyload_js2py_cve_2024_39205.rb#CVE-2024-28397 [exploit]
Nuclei · 1
CVE-2024-28397.yaml [template]
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-28397
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Js2Py 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Js2Py是Python基金会的一个库。用于将 JavaScript 转换为 Python 代码。 Js2Py 0.74 及之前版本存在安全漏洞，该漏洞源于组件 js2py.disable_pyimport() 中存在一个问题，攻击者利用该漏洞可以通过精心设计的 API 调用执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2024-28397
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | to be released | https://github.com/Marven11/CVE-2024-28397 | POC Details |
| 2 | CVE-2024-28397: js2py sandbox escape, bypass pyimport restriction. | https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape | POC Details |
| 3 | None | https://github.com/CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape | POC Details |
| 4 | An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28397.yaml | POC Details |
| 5 | This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. | https://github.com/waleed-hassan569/CVE-2024-28397-command-execution-poc | POC Details |
| 6 | The CVE-2024-28397 vulnerability affects versions of js2py up to v0.74, a Python library that allows JavaScript code to be executed within the Python interpreter. | https://github.com/0timeday/exploit-js2py | POC Details |
| 7 | None | https://github.com/harutomo-jp/CVE-2024-28397-RCE | POC Details |
| 8 | None | https://github.com/Naved124/CVE-2024-28397-js2py-Sandbox-Escape | POC Details |
| 9 | The CVE-2024-28397 vulnerability affects versions of js2py up to v0.74, a Python library that allows JavaScript code to be executed within the Python interpreter. | https://github.com/releaseown/exploit-js2py | POC Details |
| 10 | PoC exploit for CVE-2024-28397 – Remote Code Execution in pyload-ng via js2py sandbox escape | https://github.com/ExtremeUday/Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py- | POC Details |
| 11 | This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB). | https://github.com/naclapor/CVE-2024-28397 | POC Details |
| 12 | None | https://github.com/0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE | POC Details |
| 13 | This repository contains a Proof of Concept (PoC) for CVE-2024-28397, a vulnerability in the js2py library allowing a sandbox escape to achieve remote code execution. | https://github.com/nelissandro/CVE-2024-28397-Js2Py-RCE | POC Details |
| 14 | CVE-2024-28397 - Remote Code Execution From Vulnerable JS2PY | https://github.com/vitaciminIPI/CVE-2024-28397-RCE | POC Details |
| 15 | This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. | https://github.com/Ghost-Overflow/CVE-2024-28397-command-execution-poc | POC Details |
| 16 | Reverse shell for CVE-2024-28397. | https://github.com/0xPadme/CVE-2024-28397-Reverse-Shell | POC Details |
| 17 | This repository contains a Proof of Concept (PoC) for CVE-2024-28397, a vulnerability in the js2py library allowing a sandbox escape to achieve remote code execution. | https://github.com/D3ltaFormation/CVE-2024-28397-Js2Py-RCE | POC Details |
| 18 | A Python automation script for exploiting the **js2py Sandbox Escape** vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery process to achieve Remote Code Execution (RCE) on vulnerable instances. | https://github.com/L1337Xi/CVE-2024-28397-Exploit-Automation | POC Details |
| 19 | This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. | https://github.com/GhostOverflow/CVE-2024-28397-command-execution-poc | POC Details |
| 20 | js2py <= 0.74 sandbox escape (CVE-2024-28397) | https://github.com/3z-p0wn/CVE-2024-28397-exploit | POC Details |
| 21 | Professional exploit for CVE-2024-28397: Js2Py Sandbox Escape leading to Remote Code Execution (RCE). Includes modular payload generation. | https://github.com/xeloxa/CVE-2024-28397-Js2Py-RCE-Exploit | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-28397
请登录查看更多情报信息。
Other References for CVE-2024-28397 (2)
Same Patch Batch · n/a · 2024-06-20 · 13 CVEs total
| CVE-2024-36071 | 6.3 MEDIUM | SAMSUNG Magician PC Software 安全漏洞 |
| CVE-2024-30848 | SilverSky E-mail 跨站脚本漏洞 | |
| CVE-2024-31586 | Computer Laboratory Management System 跨站脚本漏洞 | |
| CVE-2024-37674 | Moodle CMS 跨站脚本漏洞 | |
| CVE-2024-37626 | TOTOLINK A6000R 安全漏洞 | |
| CVE-2024-37676 | htop 安全漏洞 | |
| CVE-2024-37818 | Strapi 安全漏洞 | |
| CVE-2024-37699 | DataLife Engine SQL注入漏洞 | |
| CVE-2024-29390 | PHPGurukul Daily Expenses Management System 安全漏洞 | |
| CVE-2024-33335 | H3C SeaSQL DWS SQL注入漏洞 | |
| CVE-2022-45929 | Northern.tech Mender 安全漏洞 | |
| CVE-2022-41324 | Northern.tech Mender 安全漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
V. Comments for CVE-2024-28397
No comments yet