CVE-2024-23346 PoC — pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

Source

https://github.com/MAWK0235/CVE-2024-23346

Associated Vulnerability

Title: pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string (CVE-2024-23346)
Description:Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.

Description

This is an exploit for CVE-2024-23346 that acts as a "terminal" (tested on chemistry.htb)

Readme


![image](https://github.com/user-attachments/assets/5e63102b-df00-42f7-b6c5-588f70724464)



<pre>/bin/python3.11 exploit.py -t &lt;target&gt; -u &lt;username&gt; -p &lt;password&gt; -l &lt;lhost&gt;</pre>

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →