Max Gabriel

ExploitDB · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

ExploitDB

EspoCRM 9.3.3 - SSRF

ExploitDB exploitPublished 2026-05-27ExploitCVE-2026-335341 file

EDB-52583

ExploitDBPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to EspoCRM and exploits CVE-2026-33534 by sending SSRF requests to the /api/v1/Attachment/fromImageUrl endpoint using alternative IPv4 loopback representations to bypass internal host validation, then stores the fetched response as an attachment.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that demonstrates the CVE-2026-33534 SSRF vulnerability by sending authenticated HTTP requests to the EspoCRM /api/v1/Attachment/fromImageUrl endpoint with various loopback IP representations. It performs no persistence, credential exfiltration, unrelated remote access, or concealed payload delivery. All behavior is consistent with a legitimate vulnerability verification tool.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareEspoCRM
Attack typesSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted requests to the vulnerable endpoint to trigger the SSRF vulnerability and create attachments on the server, which constitutes exploitation rather than mere detection or scanning.

exploits/multiple/webapps/52583.py:119-130exploits/multiple/webapps/52583.py:234-244exploits/multiple/webapps/52583.py:264-266

Requirements

  • Valid EspoCRM credentialsexploits/multiple/webapps/52583.py:183-184
  • Target EspoCRM instance URLexploits/multiple/webapps/52583.py:182

Observed behavior

  • Authenticates to EspoCRM using provided credentialsexploits/multiple/webapps/52583.py:208-209
  • Sends a control request to the fromImageUrl endpoint with 127.0.0.1 to verify blockingexploits/multiple/webapps/52583.py:217-225
  • Iterates through a list of alternative IPv4 loopback representations (octal, hex, decimal dword, etc.)exploits/multiple/webapps/52583.py:26-38
  • For each payload, sends a POST request to /api/v1/Attachment/fromImageUrl with the encoded loopback URLexploits/multiple/webapps/52583.py:234-244
  • Checks if the response indicates a successful bypass (HTTP 200 with an attachment id)exploits/multiple/webapps/52583.py:155-162
  • Optionally deletes created attachments for cleanupexploits/multiple/webapps/52583.py:251-255
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Handling
Payload withheldCredentials are used solely for authentication to the user-supplied target URL; no exfiltration to third parties is present.exploits/multiple/webapps/52583.py:183-184exploits/multiple/webapps/52583.py:208-209
Network Activity
Payload withheldAll network requests are directed at the user-provided target URL; no external or unrelated hosts are contacted.exploits/multiple/webapps/52583.py:119-130exploits/multiple/webapps/52583.py:149-152exploits/multiple/webapps/52583.py:234-244
Payload Behavior
Payload withheldThe payloads are designed to bypass internal-host validation; they are not used to download or execute arbitrary code.exploits/multiple/webapps/52583.py:26-38exploits/multiple/webapps/52583.py:234-244
Review boundaries

What the analysis did not establish

  • Only the Python script content was analyzed; no external dependencies or runtime behavior were inspected.
  • The script's actual effectiveness depends on the target's configuration and patch status, which cannot be verified from static analysis alone.
  • Only the single Python file (52583.py) was reviewed; no external dependencies beyond the standard library and the 'requests' module are inspected, but the script does not fetch or execute remote code.
  • Binary content is not present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.