1337rokudenashi

GitHub · Repository owner · Source ID 147819995
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf

Repository PoC2Created 2025-08-25Not analyzedCVE-2024-43671 file

2.0 KiB

GitHubPoC details
GitHub

1337rokudenashi/CVE-2017-5871

Repository PoC1Created 2025-08-12ScannerCVE-2017-58711 file

1337rokudenashi/Odoo-leq-8.0-20160726-and-9.0-Open-Redirect · 2.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that sends HTTP GET requests to Odoo endpoints with a redirect parameter and checks the Location header for a match, detecting the payload withheld open redirect vulnerability without exploiting it.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a Nuclei template for payload withheld, an open redirect vulnerability in Odoo. The template defines HTTP requests and a regex matcher to detect the vulnerability. No executable code, obfuscation, or deceptive behavior is present. The file is a straightforward proof-of-concept detection template.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAML
Target softwareOdoo
Attack typesopen redirect
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that sends crafted requests and matches response headers to detect an open redirect vulnerability. It does not contain code to exploit the vulnerability (e.g., to steal credentials or perform phishing), only to identify its presence, which is characteristic of a scanner.

README.md:5-48

Requirements

  • Target must be running a vulnerable Odoo instance (<= 8.0-20160726 or 9.0) with the /web/session/logout or /web/dbredirect endpoints exposed.README.md:1README.md:38-40

Observed behavior

  • Sends HTTP GET requests to paths like /web/session/logout?redirect=payload withheld and /web/dbredirect?redirect=https%3a%2f%2foast.me%2f.README.md:36-40
  • Checks the response Location header using a regex to see if it redirects to a host containing 'oast.me'.README.md:43-47
  • Stops after the first matching request.README.md:42
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
Payload withheldThe file contains a YAML-based Nuclei template for detecting an open redirect vulnerability in Odoo.README.md:5-48
Url
Payload withheldThe template uses oast.me as a test redirect target, which is a common out-of-band testing service for vulnerability scanners.README.md:38-40
Review boundaries

What the analysis did not establish

  • Only the README.md file is provided; no other repository files (e.g., template YAML file) are included.
  • The analysis is based solely on the text content of the README; the actual Nuclei template file is not present in the evidence packet.
  • The artifact's behavior is inferred from the documented template; no execution or dynamic analysis was performed.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot.
  • The digest line (line 48) is a hash and was not decoded or analyzed for hidden content, but its presence in a public template is typical for integrity verification.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.