ksaweryr

GitHub · Repository owner · Source ID 62256152
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

ksaweryr/CVE-2023-45612-PoC

Repository PoC0Created 2025-11-07ExploitCVE-2023-4561216 files

60.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends an XXE payload to a vulnerable Ktor server endpoint to achieve local file inclusion (LFI). The README describes it as a PoC for CVE-2023-45612.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and client/poc.py) describe and implement a standard XXE proof-of-concept for CVE-2023-45612. The Python client sends an XML payload with an external entity to a target server to demonstrate local file inclusion. No backdoor, deceptive payload, or concealed operator-directed harm is present in the supplied text evidence.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareJetBrains Ktor
Attack typesxxelocal file inclusion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively sends a crafted XML payload designed to trigger an XXE vulnerability and exfiltrate a local file, which constitutes exploitation, not just detection or scanning.

client/poc.py:7-21

Requirements

  • A running Ktor server instance with the vulnerable ContentNegotiation configuration and an endpoint susceptible to the attack.README.md:5

Observed behavior

  • Constructs an XML payload containing an XXE entity that references a local file ('file:///lfi_poc.txt').client/poc.py:7-17
  • Sends an HTTP POST request with the XML payload to a target server endpoint.client/poc.py:20
  • Prints the server's response, which is expected to contain the contents of the local file if the XXE is successful.client/poc.py:19-21
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xml External Entity
Payload withheldThe PoC payload uses an XXE technique to read a local file, which is the expected behavior for demonstrating CVE-2023-45612.client/poc.py:8
Network Request
Payload withheldThe script sends the XXE payload to a configurable target host and port, which is normal for a PoC client.client/poc.py:20
Review boundaries

What the analysis did not establish

  • The server-side code (Ktor application) is not included in the selected text evidence, so the vulnerable endpoint's implementation cannot be verified.
  • Two binary files (gradle-wrapper.jar and gradlew) are present but not analyzed, which may contain additional build or server logic.
  • The evidence does not confirm whether the exploit was executed or is functional.
  • Two binary files (gradle-wrapper.jar and gradlew) were not inspected; their content could contain unrelated behavior not visible in the text evidence.
  • Only 2 of 16 total files were provided as text; the remaining 14 files (including server source code) were omitted, so the review cannot assess the server-side implementation.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.