cyeezy08
Source-scoped identity with 2 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubcyeezy08/Kimai-CVE-2026-49865-POC
Repository PoCStars: 0Created 2026-07-30ExploitCVE-2026-49865CVE-2026-5282410 files
Analysis
Technical assessment
The artifact is a complete exploit toolkit for CVE-2026-52824, a critical authentication bypass in Kimai. It includes a Python script (exploit.py) that forges a KIMAI_REMEMBER cookie using a hardcoded default APP_SECRET and an empty signature_properties hash, then uses the cookie to authenticate against a target instance and access protected pages.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (README.md, exploit.py, requirements.txt) describe and implement a proof-of-concept exploit for CVE-2026-52824, a known vulnerability in Kimai. The code forges a remember-me cookie using a hardcoded default secret and attempts to access protected pages. No concealed backdoor, credential exfiltration, persistence mechanism, or unrelated payload was observed. The behavior is consistent with the stated exploit purpose.
Classification basis and observed behavior
Classification basis
The primary artifact is classified as an exploit because the main Python script (exploit.py) contains code that forges a valid authentication cookie and uses it to gain unauthorized access to a target application, which is the definition of an exploit. The README explicitly describes it as a 'Proof-of-concept exploit toolkit' and details the attack chain from advisory to admin session.
README.md:5README.md:15exploit.py:223-365Requirements
- Target must be a Kimai instance ≤ 2.57.0 using the default APP_SECRET (change_this_to_something_unique) as shipped in Docker or .env.dist.
README.md:5exploit.py:8-11 - The attacker must know or guess a valid username (e.g., admin, super_admin) and the corresponding user ID is sequential (admin = id:1).
README.md:13README.md:42
Observed behavior
- The exploit script computes a constant FieldsHash (SHA256 of empty string) and uses the known default APP_SECRET to compute an HMAC-SHA256 signature, then assembles a forged KIMAI_REMEMBER cookie.
exploit.py:70-100exploit.py:103-130 - The script sets the forged cookie in an HTTP session and attempts to access protected paths (e.g., /en/dashboard, /en/admin/user/) to verify successful authentication bypass.
exploit.py:311-365 - The README describes the toolkit as containing a single-target exploit, a multi-threaded batch exploitation script, a scanner, version probes, and a Shodan discovery script.
README.md:56-65
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, documented behavior of the PoC exploit.
exploit.py:103-130exploit.py:223-365 - Network Activity
- Payload withheldThis is expected for a PoC that validates the vulnerability on a target instance.
exploit.py:137-190exploit.py:327-360 - File Write
- Payload withheldThis is a convenience feature for saving the cookie, not a persistence mechanism.
exploit.py:292-295
What the analysis did not establish
- Only 3 of 10 files in the repository are included as readable text; the other 7 files (including batch_pwn.py, quick_scan.py, deep_probe.py, probe_batch.py, shodan-scanner.py) are omitted, so the full toolkit behavior cannot be confirmed.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files were analyzed.
- The CVE records for CVE-2026-49865 and CVE-2026-52824 are absent from the acquired CVEList, so the official vulnerability description cannot be cross-referenced.
- 7 files (53,755 bytes) were omitted from the evidence packet and not reviewed. Their content is unknown.
- The analysis is limited to static review of the provided text; no dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubcyeezy08/DoS-Braces-3.03
Repository PoCStars: 0Created 2026-07-17ExploitCVE-2024-40688 files
Analysis
Technical assessment
The artifact is a Python script (poc_braces_dos.py) that programmatically triggers a denial-of-service vulnerability in the braces npm package (version 3.0.3) by generating a combinatorial explosion via comma-separated brace expansion. It executes Node.js code that calls braces.expand() with a crafted input, measures memory and time consumption, and demonstrates the crash/OOM condition.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md and a Python PoC script (poc_braces_dos.py) that demonstrate a denial-of-service vulnerability in the braces npm package. The PoC script installs braces@3.0.3 and runs Node.js code to trigger excessive memory consumption via comma-separated brace expansion. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The script's behavior is limited to demonstrating the claimed DoS vulnerability.
Classification basis and observed behavior
Classification basis
The primary artifact is poc_braces_dos.py, which is a script that actively exercises the vulnerability by sending a malicious input to braces.expand() and observing the resulting resource exhaustion. This constitutes exploit code, as it is intended to trigger the vulnerability, not merely detect it.
poc_braces_dos.py:1-7poc_braces_dos.py:64-84Requirements
- Node.js and npm must be installed to run the script and install the vulnerable package.
poc_braces_dos.py:1 - The vulnerable braces package version 3.0.3 must be installed (the script attempts to auto-install it).
poc_braces_dos.py:9-10
Observed behavior
- The script auto-installs braces@3.0.3 if not already present.
poc_braces_dos.py:20-45 - It constructs a malicious input string by repeating the pattern '{a,b}' multiple times (e.g., 22 times for 110 characters).
poc_braces_dos.py:66 - It executes Node.js code that calls braces.expand() with the crafted input, causing the library to materialize millions of items in memory (e.g., 4,194,304 items for n=22).
poc_braces_dos.py:64-84 - It measures and reports the resulting memory consumption (e.g., +1,196,410KB) and execution time (e.g., 9723ms), demonstrating resource exhaustion.
poc_braces_dos.py:88-93 - For larger inputs (n=25), the script reports a TIMEOUT/OOM condition, indicating a successful denial of service.
poc_braces_dos.py:96-98
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThe PoC script installs a specific version of the braces package to demonstrate the vulnerability. This is expected for a PoC and does not install unrelated or malicious packages.
poc_braces_dos.py:38 - Code Execution
- Payload withheldThe PoC script executes Node.js code that calls braces.expand() with crafted input to trigger high memory usage. The executed code is fully visible and limited to the vulnerability demonstration.
poc_braces_dos.py:50-52
What the analysis did not establish
- The evidence packet includes only two text files (README.md and poc_braces_dos.py) out of eight total files in the repository. The other six files (including findings.md, verdict.md, disclosure-report.md, patch.diff, email-draft.txt) are omitted, so their content is unknown.
- The analysis is based solely on the provided text; the code was not executed, and the reported behavior is derived from the script's logic and embedded output examples.
- Six files in the repository were not provided as text content and were not analyzed. Their names and contents are unknown.
- Binary content, if any, was not inspected per the evidence envelope's binary policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.