Add Magento CosmicSting XXE (CVE-2024-34102) Detector

[lokiuox]

Hello,

Here's the detector implementation for the Adobe Commerce/Magento CosmicSting XXE (CVE-2024-34102) detector. Testbed PR here: google/security-testbeds#89

A few notes:

• The DTD_FILE_URL here will need to be updated before merging the PR so that it references the right repo/branch
• The detector falls back to response matching if the callback server is not available
• When the Callback Server is available, the exploit is made in such a way that the contents of /etc/passwd are sent as a base64-encoded URL parameter when performing the callback request. However, with the current TCS implementation there is no way to retrieve the request's body, it's only possible to know whether a callback was received or not, so Tsunami can't actually read the exfiltrated data. Still, a safe instance would not send a request at all, therefore this is still a good indicator of a vulnerable instance.

References:

• https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
• https://helpx.adobe.com/security/products/magento/apsb24-40.html
• https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/security-update-available-for-adobe-commerce-apsb24-40-revised-to-include-isolated-patch-for-cve-2024-34102

[lokiuox]

@maoning done. Just a reminder that DTD_FILE_URL needs to be updated to point to Google's repo. Would you like me to do that just before merging, so that it's correct once merged?

[maoning]

@maoning done. Just a reminder that DTD_FILE_URL needs to be updated to point to Google's repo. Would you like me to do that just before merging, so that it's correct once merged?

Could you create a separate PR to commit this file to https://github.com/google/tsunami-security-scanner-plugins/tree/master/payloads?

[lokiuox]

Here it is: #553

I proceeded to change the path in the detector already to what will be the new URL, so it can be tested as soon as the payload PR is merged.