Ibonok Exploits and Proofs of Concept

Showing 4 PoCs on this page

GitHub

Ibonok/CVE-2026-33439-PoC

Repository PoC0Created 2026-04-28ExploitCVE-2026-334399 files

4.1 MiB

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

A Java exploit for CVE-2026-33439 that generates and sends a deserialization payload to achieve pre-authentication remote code execution on OpenAM. The payload uses a PriorityQueue gadget chain (Click1 + Xalan TemplatesImpl) and a custom translet that executes OS commands via the JATO RequestManager, returning output directly in the HTTP response.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a pre-authentication RCE exploit for CVE-2026-33439 in OpenAM. The Java source code, YAML template, and README all describe and implement the same exploit chain: a deserialization payload that executes an OS command received via an HTTP header and returns the output in the response. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text files.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesJavaYAML

Target softwareOpenAM

Attack typesDeserialization of Untrusted DataRemote Code Execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Java exploit that generates a deserialization payload and sends it to a vulnerable endpoint to execute arbitrary OS commands, as demonstrated by the 'send' mode and the translet code that invokes /bin/sh -c with attacker-controlled input.

src/CVE_2026_33439_Echo.java:82-119src/CVE_2026_33439_Echo.java:123-158

Requirements

JDK 11+ with javac for translet compilation at runtimeREADME.md:11
Target OpenAM with click-nodeps-2.3.0.jar and xalan-2.7.x.jar on classpathREADME.md:12

Observed behavior

Generates a serialized Java object payload using a PriorityQueue gadget chain with Click1 ColumnComparator and Xalan TemplatesImplsrc/CVE_2026_33439_Echo.java:163-200
Compiles a custom translet class that uses JATO RequestManager to read the 'cmd' HTTP header, execute it via /bin/sh -c, and write the output to the HTTP responsesrc/CVE_2026_33439_Echo.java:123-158
Sends the payload as the jato.clientSession parameter to unauthenticated Password Reset endpoints (e.g., /sso/ui/PWResetUserValidation) via curlsrc/CVE_2026_33439_Echo.java:82-119
Includes a nuclei template that sends the payload to multiple base paths and pages, matching on 'root:.*:0:0:' in the response body to confirm exploitationCVE-2026-33439.yaml:23-62

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain: Payload withheldThe Java source code (src/CVE_2026_33439_Echo.java) constructs a serialized Java object that triggers code execution upon deserialization.src/CVE_2026_33439_Echo.java:163-200
Command Execution: Payload withheldThe translet bytecode (lines 123-158) reads the 'cmd' header, executes it via ProcessBuilder, and writes the output to the HTTP response. This is the intended RCE behavior of the PoC.src/CVE_2026_33439_Echo.java:123-158
Payload Encoding: Payload withheldThe payload is encoded to match the expected format for the jato.clientSession parameter, as described in the README and implemented in the Java code.src/CVE_2026_33439_Echo.java:247-252README.md:67-73
Network Behavior: Payload withheldThe YAML template and the Java 'send' mode both target the vulnerable endpoint with the crafted payload. The YAML matcher looks for 'root:.*:0:0:' in the response body, consistent with the exploit's goal.CVE-2026-33439.yaml:24-55src/CVE_2026_33439_Echo.java:82-119

Review boundaries

What the analysis did not establish

Four binary JAR files (click-nodeps-2.3.0.jar, javax.servlet-api-4.0.1.jar, serializer-2.7.3.jar, xalan-2.7.1.jar) were not analyzed; their contents are only known from metadata.
Two text files (build.sh, MANIFEST.MF) are present in the artifact but their content was not included in the evidence packet.
Four binary JAR files (click-nodeps-2.3.0.jar, javax.servlet-api-4.0.1.jar, serializer-2.7.3.jar, xalan-2.7.1.jar) were not analyzed. They are standard libraries used by the exploit but could theoretically contain unrelated malicious modifications.
The pre-built CVE-2026-33439-Echo.jar binary was not analyzed; only its source code was reviewed.
Two text files (build.sh, MANIFEST.MF) were not included in the evidence packet and were not reviewed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub