PawelMurdzek

GitHub · Repository owner · Source ID 105887950
Source profile

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

GitHub

PawelMurdzek/CVE-2024-38355-PoC

Repository PoC0Created 2025-12-23ExploitCVE-2024-38355CVE-2024-475549 files

11.3 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Node.js exploit client that sends a crafted Socket.IO packet to trigger an uncaught exception on a vulnerable server, causing a denial-of-service crash. It includes a vulnerable server for demonstration and a step-by-step exploit script that verifies the server is no longer reachable after the attack.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and an exploit script for CVE-2024-38355. The exploit script connects to a target server, sends a normal message, then sends a crafted payload to trigger a server crash, and finally checks if the server is unreachable. This behavior is consistent with a proof-of-concept denial-of-service demonstration and does not exhibit any backdoor, concealed operator-directed harm, or unrelated payload.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesJavaScriptMarkdown
Target softwaresocket.io
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The exploit/exploit.js file contains code that actively sends a malicious payload to crash a target server, which is the definition of an exploit. The README describes it as a 'Proof of Concept' and the code includes steps to verify the server crash, confirming its purpose is to exercise the vulnerability.

exploit/exploit.js:43-47README.md:3README.md:28-29

Requirements

  • A running Socket.IO server with a vulnerable version (<2.5.1 or >=3.0.0,<4.6.2) and an event handler that throws an uncaught exception on receiving specific data.README.md:7-9README.md:114-122
  • Network access to the target server.exploit/exploit.js:3

Observed behavior

  • Connects to the target Socket.IO server and sends a normal 'process_data' event to confirm connectivity.exploit/exploit.js:11-17
  • Sends a malicious 'process_data' event with a payload ({ trigger: 'crash' }) designed to cause an uncaught exception on the server.exploit/exploit.js:40-47
  • Attempts to reconnect to the server to verify it has crashed and is no longer reachable.exploit/exploit.js:61-86
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the core PoC action for CVE-2024-38355, demonstrating the uncaught exception crash.exploit/exploit.js:47
Target Connection
Payload withheldThe target is configurable via environment variable, defaulting to localhost:3000. No hardcoded external C2 or data exfiltration endpoint is present.exploit/exploit.js:3
Review boundaries

What the analysis did not establish

  • Only two of nine text files were included in the evidence packet; the vulnerable server code (server/index.js) and other project files were omitted.
  • The evidence packet metadata indicates 7 unclassified files totaling 3710 bytes were not analyzed.
  • Only two text files (README.md and exploit/exploit.js) were included in the evidence; 7 other files in the repository were omitted from the text content. The metadata indicates these are likely configuration files (e.g., package.json, Dockerfile) and a server script, but their content was not reviewed.
  • Binary files were not analyzed; the evidence policy flagged them as metadata-only, but no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.