NiteeshPujari
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubNiteeshPujari/CVE-2024-37054-MLflow-RCE
Repository PoCStars: 2Created 2025-08-22ExploitCVE-2024-370545 files
Analysis
Technical assessment
The artifact is a Proof of Concept (PoC) for CVE-2024-37054, a deserialization vulnerability in MLflow. It contains two Python scripts: one that logs a malicious model containing a pickled payload (poc/log_malicious_model.py), and another that loads the model, triggering arbitrary code execution via cloudpickle deserialization (poc/load_vulnerable_model.py). The README explicitly describes the steps to execute the attack and observe the RCE.
Backdoor review
No backdoor observed in reviewed code
The repository is a documented Proof of Concept for CVE-2024-37054, demonstrating a known MLflow deserialization vulnerability. The payload (os.system call) is explicitly described in the README and source code as the intended exploit demonstration. No concealed, unrelated, or operator-directed harmful behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact contains functional Python code that, when executed, logs a malicious model and then loads it to trigger arbitrary command execution. The README explicitly labels it as a 'Proof of Concept (PoC)' and provides step-by-step instructions to perform the attack. This is code intended to exercise a vulnerability, meeting the definition of an exploit.
README.md:19README.md:34poc/log_malicious_model.py:1-53poc/load_vulnerable_model.py:1-30Requirements
- A vulnerable MLflow server (version 0.9.0 to <2.14.2) must be running and accessible.
README.md:49Dockerfile:26 - The attacker must be able to log a model to the MLflow tracking server (no authentication required by default).
poc/log_malicious_model.py:6poc/log_malicious_model.py:46-50 - The victim must load the malicious model using mlflow.pyfunc.load_model.
poc/load_vulnerable_model.py:24
Observed behavior
- The attacker script defines a class with a __reduce__ method that returns (os.system, (cmd,)), where cmd is a shell command. When the model is logged, this object is pickled and stored on the MLflow server.
poc/log_malicious_model.py:17-23 - The victim script loads the model using mlflow.pyfunc.load_model, which deserializes the pickled object via cloudpickle.load, causing the __reduce__ method to execute the attacker's shell command.
poc/load_vulnerable_model.py:21-24README.md:48 - The payload creates a file named 'pwned.txt' and prints a message to confirm code execution.
poc/log_malicious_model.py:22README.md:155
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThe payload is the core of the CVE-2024-37054 PoC, designed to execute a harmless command (print message, create file) to confirm code execution.
poc/log_malicious_model.py:22-23README.md:96-97 - Vulnerable Dependency
- Payload withheldThe Dockerfile installs a version of MLflow known to be vulnerable to CVE-2024-37054, which is the target of the PoC.
Dockerfile:26
What the analysis did not establish
- One file (LICENSE) is omitted from the text evidence; it is unlikely to contain exploit code.
- The evidence does not include the execution output or confirmation that the code was run successfully.
- One file (LICENSE) was omitted from the text evidence; its content is not available for review, but it is typically a standard license file and unlikely to contain executable behavior.
- The review is limited to the supplied text files; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubNiteeshPujari/CVE-2025-32433-PoC
Repository PoCStars: 7Created 2025-08-13ExploitCVE-2025-324334 files
Analysis
Technical assessment
Python script that sends crafted SSH protocol messages (KEXINIT, CHANNEL_OPEN, CHANNEL_REQUEST) to an Erlang/OTP SSH server before authentication to achieve remote code execution by executing an arbitrary Erlang command.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and a Python exploit script for CVE-2025-32433. The script implements a standard SSH pre-authentication RCE exploit against a vulnerable Erlang/OTP server. It constructs and sends SSH protocol messages (KEXINIT, CHANNEL_OPEN, CHANNEL_REQUEST) to execute an attacker-supplied Erlang command. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The script's behavior is consistent with its stated purpose as a proof-of-concept exploit.
Classification basis and observed behavior
Classification basis
The Python script constructs and sends SSH protocol messages (KEXINIT, CHANNEL_OPEN, CHANNEL_REQUEST) to a target server before authentication is completed, with the explicit purpose of executing an arbitrary command on the target. This is code intended to exercise a vulnerability, meeting the definition of an exploit.
cve_2025_32433_exploit.py:1cve_2025_32433_exploit.py:260-265README.md:1-5Requirements
- Target must be running a vulnerable Erlang/OTP SSH server (e.g., OTP-26.2.5.10 as built by the Dockerfile).
Dockerfile:14README.md:22 - Attacker must have network connectivity to the target SSH port (default 2222).
cve_2025_32433_exploit.py:231
Observed behavior
- Sends a client SSH banner to initiate the connection.
cve_2025_32433_exploit.py:235-237 - Sends a crafted SSH_MSG_KEXINIT packet to start key exchange.
cve_2025_32433_exploit.py:245-249 - Sends an SSH_MSG_CHANNEL_OPEN packet to open a session channel without completing authentication.
cve_2025_32433_exploit.py:253-257 - Sends an SSH_MSG_CHANNEL_REQUEST packet with an 'exec' payload containing an arbitrary Erlang command to execute on the target.
cve_2025_32433_exploit.py:261-265 - Default payload writes a file '/tmp/note.txt' on the target to demonstrate code execution.
cve_2025_32433_exploit.py:39-40 - Supports user-supplied Erlang commands, including reverse shell payloads via os:cmd().
cve_2025_32433_exploit.py:196-205
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented exploit mechanism for CVE-2025-32433 and matches the vulnerability description.
cve_2025_32433_exploit.py:19-48cve_2025_32433_exploit.py:252-265 - Default Command
- Payload withheldThe default command creates a harmless file on the target, demonstrating RCE without malicious impact.
cve_2025_32433_exploit.py:38-40cve_2025_32433_exploit.py:196-197 - Listener Code
- Payload withheldThe listener code is present but unused; it does not establish any backdoor or unauthorized access.
cve_2025_32433_exploit.py:101-171cve_2025_32433_exploit.py:174-288
What the analysis did not establish
- One file (ssh_server.erl) is referenced in the Dockerfile and README but its content is not included in the evidence; the exploit script's interaction with the server's behavior cannot be fully verified.
- The evidence does not include any captured network traffic or execution output confirming the exploit works against a live target.
- One file (ssh_server.erl) was omitted from the text evidence; its content is unknown and could theoretically contain unrelated behavior, though the Dockerfile shows it is compiled and used to start the vulnerable SSH server.
- Binary content was not analyzed; the review is limited to the supplied readable text files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.