Kenneth LaCroix
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
MetasploitBerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner
Metasploit auxiliary PoCby Tencent YunDing Security LabAdded to Metasploit 2026-06-14ScannerCVE-2026-422081 file
Analysis
Technical assessment
A Metasploit auxiliary module that detects BerriAI LiteLLM proxy servers vulnerable to CVE-2026-42208 using a benign time-based blind SQL injection check. It sends two requests with different injected predicates and flags the target only when the first is delayed and the second is not, without reading or exfiltrating data.
Backdoor review
No backdoor observed in reviewed code
The module is a scanner for CVE-2026-42208. It performs a benign time-based SQL injection check using the framework's PostgreSQLi::TimeBasedBlind library, issues two requests (one with a tautology, one without), and reports vulnerable only when the first is delayed and the second is not. No data exfiltration, persistence, credential theft, or unrelated payload delivery is present. The code is straightforward and matches the documented purpose.
Classification basis and observed behavior
Classification basis
The module's description and source code state it only detects the vulnerability using a time-based check without exploiting it to read or modify data. The check method returns a vulnerability status, and the module is classified as an auxiliary scanner in Metasploit.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:16-17modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-34modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:127-134Requirements
- Target must have at least one virtual key provisioned in the token table; an empty table causes the time-based probe to fail.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:36-41
Observed behavior
- Sends a POST request to the chat completions endpoint with an Authorization header containing a time-based blind SQL injection payload that sleeps only when a tautology is true.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:107-125 - Sends a second request with a predicate that never sleeps, and reports the target vulnerable only if the first request is delayed while the second returns promptly.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-33 - Does not read, exfiltrate, or modify data; the check is benign and crash-safe.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-34modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:55
Behaviors behind the backdoor verdict
Observables
- SQL Injection Probe
- Payload withheldThe module constructs a time-based blind SQLi payload using the framework's create_sqli method. The payload is injected into the Authorization header to trigger pg_sleep for vulnerability detection. The random suffix defeats caching. This is the expected behavior for a CVE-2026-42208 scanner.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:107-125 - Network Request
- Payload withheldThe module sends a POST request to the configured chat completions endpoint with a minimal JSON body and the SQLi payload in the Authorization header. This is the delivery mechanism for the vulnerability check.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:114-123 - Vulnerability Reporting
- Payload withheldWhen the time-based check confirms vulnerability, the module reports the finding via the Metasploit report_vuln API. This is standard auxiliary module behavior.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:144-150
What the analysis did not establish
- Only the module source and metadata are provided; framework mixins (e.g., Msf::Exploit::SQLi, PostgreSQLi::TimeBasedBlind) are not expanded, so the exact SQLi test logic is partially opaque.
- The evidence does not include any execution output or network traffic, so the module's behavior is inferred solely from its source code and description.
- Review is limited to the module source file; framework mixins (Msf::Exploit::SQLi, HttpClient, etc.) are not expanded, but their documented behavior is well-known and consistent with the observed usage.
- No binary or non-text files were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitNext.js Middleware Authorization Bypass Scanner
Metasploit auxiliary PoCby Rachid Allam, plus 1 additional contributorAdded to Metasploit 2026-06-13ScannerCVE-2025-299271 file
Analysis
Technical assessment
Metasploit auxiliary module that detects Next.js applications vulnerable to CVE-2025-29927 by sending a baseline request and a request with a crafted x-middleware-subrequest header, then comparing responses to determine if middleware authorization is bypassed. It reports vulnerability but does not exploit it.
Backdoor review
No backdoor observed in reviewed code
The module is a straightforward vulnerability scanner for CVE-2025-29927. It sends HTTP GET requests with and without the x-middleware-subrequest header to detect an authorization bypass. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only detection and reporting, consistent with its documented purpose.
Classification basis and observed behavior
Classification basis
The module description states 'This is detection only; the module does not act on the bypassed response.' The code only sends requests and compares responses to determine vulnerability; it does not extract data, establish sessions, or perform any post-bypass actions.
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:47Requirements
- Target must be a self-hosted Next.js application with middleware protecting a path
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:33-40 - User must supply a path normally gated by middleware (TARGETURI)
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:72
Observed behavior
- Sends a baseline GET request to the user-supplied TARGETURI and checks if the response status is a gate code (301, 302, 303, 307, 308, 401, 403)
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:98-100modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:130-131 - Sends additional GET requests with various x-middleware-subrequest header values and compares responses to the baseline to detect if the middleware gate is bypassed
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:108-125 - Reports the target as vulnerable if the gate disappears or the redirect target changes, and logs the vulnerability via report_vuln
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:137modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:158-165
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldCore detection logic; sends crafted header to test for middleware bypass.
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:111-115 - Vulnerability Reporting
- Payload withheldStandard Metasploit vulnerability reporting; no exfiltration or unrelated action.
modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:159-165
What the analysis did not establish
- Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of send_request_cgi and report_vuln is not verified from source.
- Only the module source and metadata were reviewed; Metasploit framework mixins (e.g., HttpClient, Scanner) and external libraries are not expanded, but the module's own code shows no backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitAudiobookshelf Unauthenticated API Authentication Bypass Scanner
Metasploit auxiliary PoCby swiftbird07Added to Metasploit 2026-06-13ScannerCVE-2025-252051 file
Analysis
Technical assessment
This Metasploit auxiliary module detects Audiobookshelf servers vulnerable to CVE-2025-25205 by fingerprinting the version and performing a differential check against a protected API endpoint. It sends a baseline request expected to return 401 and a bypass request with a crafted query parameter; a non-401 response on the bypass request confirms the vulnerability. The module does not exploit the vulnerability to extract data or gain access.
Backdoor review
No backdoor observed in reviewed code
The module is a straightforward vulnerability scanner for CVE-2025-25205. It fingerprints the target, sends a baseline and a bypass HTTP request to detect the authentication bypass, and reports the result. No backdoor, deceptive payload, or concealed operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The module's description and code explicitly state it 'detects' vulnerable servers and performs a differential check to confirm the bypass without exploiting it for data access. It sends requests and observes responses to determine vulnerability status, which is the definition of a scanner.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:20-37modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:82-103Requirements
- Target must be running Audiobookshelf server accessible over HTTP.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:70-73 - The /status endpoint must be reachable and return a JSON document identifying the application as 'audiobookshelf'.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:70-77
Observed behavior
- Fingerprints the target by requesting the /status endpoint and parsing the JSON response for the 'serverVersion' field.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:69-80 - Sends a baseline GET request to /api/libraries and verifies it receives an HTTP 401 response.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:88-93 - Sends a bypass GET request to /api/libraries with a query parameter 'r' set to '/api/items/1/cover' and checks if the response code is 200 or 500.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:95-102 - Reports the vulnerability if the bypass is confirmed, or reports the target as safe/appears vulnerable based on version and check results.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:105-121modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:123-144
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldThese are the only HTTP requests made by the module, used for fingerprinting and vulnerability detection as described in the module metadata.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:70-73modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:89-92modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:95-99 - Vulnerability Report
- Payload withheldThe module reports the confirmed vulnerability to the Metasploit database, which is standard behavior for a scanner module.
modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:137-143
What the analysis did not establish
- Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of send_request_cgi and other helper methods is not visible.
- The evidence does not include any execution output or network traffic, so the analysis is based solely on static code review.
- The analysis is limited to the module source code and metadata. Framework mixins (e.g., HttpClient, Scanner) and external payloads are not expanded, but the module itself does not invoke any payloads or exhibit suspicious behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.