DonVorrin
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubDonVorrin/CVE-2023-29357
Repository PoCStars: 0Created 2026-04-13Model review verdict: Suspicious behavior.ExploitCVE-2023-293571 file
AnalysisSuspicious behavior
Technical assessment
Python script that exploits CVE-2023-29357, a SharePoint authentication bypass, by forging JWT tokens with algorithm 'none' to authenticate and retrieve admin users, then spoofing their identities to access protected endpoints.
Backdoor review
Suspicious behaviorThe PoC is a SharePoint CVE-2023-29357 authentication bypass exploit. It contains a hardcoded proxy configuration (lines 18-23) that routes all exploit traffic through a local proxy (127.0.0.1:8080) without any user-facing option to disable it. This proxy is not disclosed in the script's argument help or documentation, and it silently intercepts all HTTP requests made by the tool, including authentication tokens and target responses. This concealed traffic redirection creates a material risk of credential and data exfiltration to a local listener controlled by an unknown party.
Classification basis and observed behavior
Classification basis
The script actively forges authentication tokens to gain unauthorized access and impersonate admin users, which constitutes exploitation, not mere detection.
exploit.py:75-118exploit.py:144-186Requirements
- Target SharePoint instance vulnerable to CVE-2023-29357 (accepts 'alg':'none' JWTs).
exploit.py:93 - Network access to the target SharePoint URL.
exploit.py:29-30
Observed behavior
- Retrieves SharePoint realm from WWW-Authenticate header on a 401 response.
exploit.py:42-67 - Constructs a JWT with 'alg':'none' and an empty signature, then sends it to /_api/web/siteusers to authenticate.
exploit.py:120-186 - Extracts admin users from the authenticated response and spoofs their identity by forging additional JWTs to access /_api/web/currentuser.
exploit.py:75-118 - Supports mass scanning via thread pool and LeakIX integration to find vulnerable hosts.
exploit.py:213-266
Behaviors behind the backdoor verdict
Flagged behaviors
- The script hardcodes a proxy configuration (PROXY_URL = 'payload withheld') and applies it to every requests.Session (lines 18-23, 192-193). This proxy is not mentioned in the argparse help or any user documentation, and there is no command-line flag to disable it. All exploit traffic, including JWT tokens and target responses, is silently routed through this local proxy, which could be used by a local attacker to capture sensitive data without the operator's knowledge.
exploit.py:18-23exploit.py:192-193exploit.py:239-248
Observables
- Hardcoded Proxy
- Payload withheldA hardcoded HTTP/HTTPS proxy applied to all exploit sessions without user opt-in or disclosure.
exploit.py:18-23
What the analysis did not establish
- Evidence is a single Python file; no runtime execution or verification was performed.
- The script includes hardcoded proxy settings (lines 18-23) that may affect behavior if not configured.
- LeakIX API key is required for the --leakpy feature (line 214).
- The review is limited to the single readable text file (exploit.py). No binary or network evidence was inspected.
- The proxy destination is localhost; no evidence confirms a listening service or remote exfiltration.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.