CVE-2025-34282 Exploit Metadata

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

A Python script that automates a two-step SSRF exploit against ThingsBoard < 4.2.1 by uploading a crafted SVG file and creating a widget that triggers a server-side request to an attacker-controlled URL.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2025-34282. The script performs only the documented SSRF exploit steps: uploading an SVG file and creating a widget that references the uploaded file. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor payloads were observed.

ClassificationExploit

Model confidence95%

AuthenticationRequired

Languagespython

Target softwareThingsBoard

Attack typesserver-side request forgery (ssrf)

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively performs the attack steps (uploading a malicious SVG and creating a widget) to cause the server to make an unintended outbound request, which is the definition of an exploit. It does not merely detect or report the vulnerability.

thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:1-3thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:142-161

Requirements

Tenant Admin bearer token for the target ThingsBoard instancethingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:20-22
A crafted SVG file containing an internal URL reference (e.g., http://127.0.0.1:5555)README.md:30-31
Network listener on the attacker's machine to receive the SSRF callbackREADME.md:52-55

Observed behavior

Uploads a user-supplied SVG file to the ThingsBoard /api/image endpoint using a Bearer tokenthingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:62-91
Extracts the publicLink of the uploaded image from the API responsethingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:147-151
Creates a custom widget via /api/widgetType that embeds the SVG's publicLink inside an <object> tag, causing the server to fetch the SVG and trigger the SSRFthingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:93-108thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:135-137

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Endpoint: http://localhost:8080/api/imageTarget endpoint for the SSRF exploit's SVG upload step.thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:57
Network Endpoint: http://localhost:8080/api/widgetTypeTarget endpoint for the SSRF exploit's widget creation step.thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:58
Network Endpoint: http://127.0.0.1:5555Internal URL embedded in the SVG payload to demonstrate SSRF.README.md:30thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:37

Review boundaries

What the analysis did not establish

The actual SVG payload file (ssrf_localhost_5555.svg) is not included in the selected text evidence; only its description and a snippet are present in README.md and the Python script comments.
The evidence does not include the server response or any captured network traffic confirming successful SSRF execution.
One file (543 bytes) was classified as unclassified and was not inspected; its content is unknown.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2025-34282