EntroVyx

GitHub · Repository owner · Source ID 105095226
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

EntroVyx/CVE-2026-33657

Repository PoC0Created 2026-05-11ExploitCVE-2026-336573 files

15.8 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to EspoCRM, creates a Note containing attacker-controlled HTML, and confirms storage of the payload. The script is designed to exercise CVE-2026-33657 by injecting HTML that will be rendered unescaped in email notifications.

Backdoor review

No backdoor observed in reviewed code

The PoC script CVE-2026-33657.py and its README.md describe and implement an authenticated stored HTML injection exploit against EspoCRM 9.3.3, consistent with the claimed CVE-2026-33657. The script uses provided credentials to authenticate, optionally fingerprint the version, create a Note containing attacker-controlled HTML, and confirm storage. No concealed executable behavior, unrelated payload, credential exfiltration, persistence mechanism, or operator-directed harm was observed. The script's actions are limited to the described exploit flow.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareespocrm
Attack typesstored html injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively creates a malicious Note with HTML payload on a target EspoCRM instance, which is the core action needed to trigger the stored HTML injection vulnerability. It does not merely detect the version or report exposure; it performs the injection step.

CVE-2026-33657.py:3CVE-2026-33657.py:90-104CVE-2026-33657.py:256

Requirements

  • Valid EspoCRM credentials with permission to create stream NotesCVE-2026-33657.py:177-178
  • Notification target via --mention or --target-user-idCVE-2026-33657.py:204-207

Observed behavior

  • Authenticates to EspoCRM using supplied credentialsCVE-2026-33657.py:193-196
  • Optionally fingerprints EspoCRM version via /api/v1/App/userCVE-2026-33657.py:209-218
  • Creates a Note with attacker-controlled HTML in the post fieldCVE-2026-33657.py:220-232
  • Confirms the stored Note contains the injected HTML payloadCVE-2026-33657.py:252-256
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldDefault tracking pixel URL used in the default payload, consistent with the described HTML injection for email tracking.CVE-2026-33657.py:183
Url
Payload withheldDefault link URL used in the default payload, consistent with demonstrating HTML injection impact.CVE-2026-33657.py:184
Review boundaries

What the analysis did not establish

  • The script does not trigger or verify email delivery; it only stores the payload and relies on the server's notification job to send the email.
  • The evidence does not include execution output or confirmation that the script was run against a live target.
  • One file (metadata only) was not provided as text and was not analyzed; its content is unknown.
  • The review is limited to static analysis of the supplied text; the script was not executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

EntroVyx/CVE-2026-33534

Repository PoC0Created 2026-05-08ExploitCVE-2026-335344 files

16.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to EspoCRM, sends SSRF payloads using alternative IPv4 loopback representations to the /api/v1/Attachment/fromImageUrl endpoint, and confirms vulnerability by checking for stored attachments.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script and a README for CVE-2026-33534, an authenticated SSRF vulnerability in EspoCRM. The script sends HTTP requests to a target EspoCRM instance using provided credentials, tests various alternative IPv4 loopback representations to bypass internal host validation, and optionally cleans up created attachments. All behavior is consistent with a legitimate proof-of-concept for the described vulnerability. No concealed executable behavior, credential exfiltration, persistence mechanisms, or unrelated payloads were observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareEspoCRM
Attack typesServer-Side Request Forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted requests to exploit the SSRF vulnerability by making the server fetch internal resources and store the response as an attachment. It does not merely detect or report the vulnerability; it exercises it to produce a tangible effect (stored attachment).

CVE-2026-33534.py:3CVE-2026-33534.py:119-130CVE-2026-33534.py:234-244CVE-2026-33534.py:155-162

Requirements

  • Valid EspoCRM credentials with permission to use the target image/attachment fieldREADME.md:22-24
  • Python 3 with requests library installedREADME.md:21-22

Observed behavior

  • Authenticates to EspoCRM using provided username and passwordCVE-2026-33534.py:208-209
  • Sends a control request with direct loopback IP 127.0.0.1 to verify blockingCVE-2026-33534.py:217-225
  • Iterates through alternative IPv4 loopback representations (octal, hex, decimal) and sends each as the image URL to the fromImageUrl API endpointCVE-2026-33534.py:234-244
  • Checks if the server returned HTTP 200 with an attachment ID, indicating successful SSRF and stored attachmentCVE-2026-33534.py:155-162
  • Optionally deletes created attachments after successful exploitationCVE-2026-33534.py:251-255
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldAdvisory URL referenced in the exploit script and README, consistent with the CVE description.CVE-2026-33534.py:10README.md:15
Url
Payload withheldVendor homepage referenced in the exploit script header.CVE-2026-33534.py:6
Url
Payload withheldSoftware link referenced in the exploit script header.CVE-2026-33534.py:7
Url
Payload withheldExploit author's GitHub profile referenced in the script header.CVE-2026-33534.py:5
Review boundaries

What the analysis did not establish

  • Evidence includes only two of four repository files; two files (likely LICENSE and .gitignore) are omitted from text content.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness against a live target is not verified.
  • Two additional files in the repository (total 4 files, 2 omitted) were not included in the text evidence; their content is unknown.
  • The analysis is limited to static review of the provided source code; no dynamic execution or binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.