fuchiuebusi-lab

GitHub · Repository owner · Source ID 293873683
Source profile

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

GitHub

fuchiuebusi-lab/nginx-ui-CVE-2026-42221-CVE-2026-42238-

Repository PoC0Created 2026-06-23ExploitCVE-2026-42221CVE-2026-4223816 files

23.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit_42221.py) that actively exploits CVE-2026-42221 by sending a crafted POST request to the unauthenticated /api/install endpoint of a vulnerable nginx-ui instance to create an attacker-controlled administrator account.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a Python exploit script for CVE-2026-42221. The README describes a lab environment for testing two known nginx-ui CVEs. The exploit script performs the documented unauthenticated admin account claim against a local test instance. No concealed executable behavior, persistence, credential exfiltration, or unrelated payloads were observed. The script's actions are consistent with the stated CVE proof-of-concept.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarenginx-ui
Attack typesauthentication bypassaccount takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script exploit_42221.py performs all steps required to exploit CVE-2026-42221: it interacts with the vulnerable endpoint, encrypts attacker-chosen credentials, and sends them to create an unauthorized administrator account. This is active exploitation, not mere detection or scanning.

scripts/exploit_42221.py:1-77README.md:50

Requirements

  • A vulnerable nginx-ui instance (v2.3.7 or earlier) must be running and accessible at payload withheld, and it must not have been set up yet (lock=false).scripts/exploit_42221.py:9scripts/exploit_42221.py:30-36
  • The attacker must have network access to the target instance.scripts/exploit_42221.py:9
  • The Python pycryptodome library must be installed to perform RSA encryption.README.md:63-67scripts/exploit_42221.py:6-7

Observed behavior

  • Checks the /api/install endpoint to confirm the target is in an uninitialized state (lock=false).scripts/exploit_42221.py:30-36
  • Retrieves the RSA public key from the /api/crypto/public_key endpoint.scripts/exploit_42221.py:39-45
  • Constructs a JSON payload containing attacker-controlled username, password, and email, then encrypts it with the retrieved RSA public key.scripts/exploit_42221.py:48-63
  • Sends the encrypted payload to the /api/install endpoint via an unauthenticated POST request to create the administrator account.scripts/exploit_42221.py:66-69
  • Reports success if the HTTP response status is 200/201 or the JSON response code is 0, indicating the attacker account was created.scripts/exploit_42221.py:71-75
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Script
Payload withheldPython script that exploits CVE-2026-42221 by claiming the initial admin account on a local nginx-ui instance via the unauthenticated /api/install endpoint.scripts/exploit_42221.py:1-77
Target Url
Payload withheldThe exploit script targets a local nginx-ui instance, consistent with the README's instructions for a local Docker lab environment.scripts/exploit_42221.py:9
Attacker Credentials
Payload withheldHardcoded credentials used by the exploit to create the admin account. These are used locally and do not indicate exfiltration.scripts/exploit_42221.py:10-12
Review boundaries

What the analysis did not establish

  • Only 2 of 16 text files in the repository were included in the evidence packet. The remaining 14 files (including scripts/encrypt_password.py, scripts/test_patched.py, Dockerfiles, and configuration files) were omitted, so the full scope of the repository cannot be assessed.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all artifacts from the repository snapshot are represented.
  • Only 2 of 16 repository files were provided as text; the remaining 14 files (including other scripts, Dockerfiles, and configuration files) were not inspected. The verdict applies only to the reviewed README.md and payload withheld.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.