sonnelon
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubsonnelon/CVE-2026-33017-PoC
Repository PoCStars: 0Created 2026-08-13ExploitCVE-2026-330171 file
Analysis
Technical assessment
A Python script that exploits CVE-2026-33017 in Langflow by sending a crafted POST request to the unauthenticated payload withheld endpoint. The payload contains a custom component with embedded Python code that executes a reverse shell via os.system().
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Python script that exploits CVE-2026-33017 by sending a crafted POST request to a target Langflow instance. The payload contains a reverse shell connecting back to the operator-supplied host and port. All behavior is consistent with the disclosed unauthenticated RCE exploit, and no concealed or deceptive actions targeting the operator were found.
Classification basis and observed behavior
Classification basis
The script actively sends a crafted payload to a vulnerable endpoint to achieve remote code execution via a reverse shell, which is the definition of an exploit.
exploit.py:1-110Requirements
- Target Langflow instance with a public flow ID
exploit.py:9 - Attacker-controlled listener to receive reverse shell
exploit.py:10-11
Observed behavior
- Constructs a reverse shell payload using os.system() with a bash TCP reverse shell command
exploit.py:16-28 - Embeds the reverse shell code inside a custom Langflow component definition in a JSON payload
exploit.py:30-83 - Sends an unauthenticated POST request to the vulnerable build_public_tmp endpoint with the malicious payload
exploit.py:85-103
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- Payload withheldThe exploit payload executes a reverse shell on the target, connecting back to the operator-controlled address and port provided via command-line arguments.
exploit.py:19 - Target Endpoint
- Payload withheldThe script sends the exploit payload to this unauthenticated endpoint on the target server, which is the vulnerable endpoint described in CVE-2026-33017.
exploit.py:86
What the analysis did not establish
- The review is based solely on the provided text of exploit.py; no other files or runtime behavior were examined.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubsonnelon/CVE-2026-23744-PoC
Repository PoCStars: 0Created 2026-08-10ExploitCVE-2026-237443 files
Analysis
Technical assessment
Python script that sends a crafted HTTP POST request to a vulnerable MCPJam inspector endpoint to trigger installation of an MCP server, resulting in a reverse shell via netcat.
Backdoor review
No backdoor observed in reviewed code
The PoC exploit.py sends a crafted HTTP POST to the target's payload withheld endpoint with a serverConfig that instructs the target to execute 'payload withheld', establishing a reverse shell. This behavior directly matches the described CVE-2026-23744 remote code execution vulnerability. No concealed, unrelated, or operator-directed harmful behavior beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The script actively sends a malicious payload to the target to achieve remote code execution via a reverse shell, which is the definition of an exploit.
exploit.py:26-45Requirements
- Target running vulnerable MCPJam inspector (<= 1.4.2) with the payload withheld endpoint exposed.
exploit.py:27 - Attacker must have a netcat listener running on a reachable IP and port to receive the reverse shell.
exploit.py:8-9
Observed behavior
- Sends an unauthenticated HTTP POST request to payload withheld with a JSON payload specifying a server command (busybox nc) that connects back to the attacker's IP and port, executing /bin/bash.
exploit.py:27-45 - Checks if the response status code is not 404 to determine success.
exploit.py:46-47
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- Payload withheldThe PoC payload instructs the vulnerable MCPJam inspector to spawn a reverse shell to the attacker-controlled IP and port, consistent with the CVE description of RCE via crafted HTTP request.
exploit.py:31-37 - Target Endpoint
- Payload withheldThe HTTP endpoint targeted by the exploit, matching the vulnerability description of an unauthenticated MCP server installation endpoint.
exploit.py:27
What the analysis did not establish
- One file (README.md) is omitted from the text evidence; its content is unknown.
- The evidence does not include the execution output or verification that the exploit works.
- One file (unclassified, 6 bytes) was omitted from text analysis; its metadata-only presence does not indicate backdoor behavior but prevents full artifact inspection.
- Binary files were not analyzed; none were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubsonnelon/CVE-2025-59528-PoC
Repository PoCStars: 0Created 2026-08-10ExploitCVE-2025-595283 files
Analysis
Technical assessment
Python script that sends a crafted HTTP POST request to a Flowise instance to achieve remote code execution via a reverse shell. The payload exploits a code injection vulnerability in the mcpServerConfig parameter by using the Function() constructor to execute a shell command.
Backdoor review
No backdoor observed in reviewed code
The PoC demonstrates the documented CVE-2025-59528 remote code execution vulnerability against Flowise 3.0.5. The exploit payload sends a reverse shell command to the target server, which is the expected behavior for a PoC of this CVE. No concealed backdoor, unrelated payload, or operator-directed harm beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a Python script (exploit.py) that actively sends a malicious payload to a vulnerable endpoint to execute arbitrary commands on the target server, which is the definition of an exploit.
exploit.py:16exploit.py:30-31Requirements
- Requires a valid API key for the target Flowise instance.
exploit.py:35 - Requires a network listener (e.g., netcat) to receive the reverse shell.
README.md:44-47
Observed behavior
- Constructs a JSON payload containing a reverse shell command inside the mcpServerConfig field.
exploit.py:12-19 - Sends an HTTP POST request to the /api/v1/node-load-method/customMCP endpoint with the payload and an Authorization header.
exploit.py:24-31 - Checks the HTTP response status code to report success or failure.
exploit.py:44-47
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Payload
- Payload withheldThe payload creates a reverse shell connection back to the attacker-controlled IP and port, which is the intended demonstration of remote code execution for CVE-2025-59528.
exploit.py:16
What the analysis did not establish
- One file (likely a screenshot or image) was omitted from the text evidence and not analyzed.
- The evidence does not include the execution output or verification that the exploit works.
- One file (metadata only) was omitted from the evidence and not reviewed.
- Binary content was not analyzed; the artifact contained no identified binary files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.