clemfavre/cve-2023-45612_exploit

GitHubRepository PoCWriteup

PoC files

125 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing CVE-2023-45612, an XXE vulnerability in JetBrains Ktor. It provides a detailed reproduction guide, including server setup, normal and malicious XML payloads, and curl commands, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept (PoC) for CVE-2023-45612, an XXE vulnerability in JetBrains Ktor. All reviewed text files (README, build script, server source, Gradle wrapper, settings) describe or implement a legitimate demonstration of the vulnerability and its patch. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied evidence.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesmarkdownkotlinxmlbash
Target softwareJetBrains Ktor
Attack typesxxe
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that explains the vulnerability, provides XML payload examples, and gives remediation advice. It does not contain any code that automatically exploits or scans for the vulnerability; the provided Kotlin server code is a demonstration target, not an exploit or scanner.

README.md:1-56server/src/main/kotlin/Main.kt:1-38

Requirements

  • A Ktor server running version 2.3.4 with XML content negotiation enabled.README.md:9server/build.gradle.kts:20-22

Observed behavior

  • The writeup describes sending a malicious XML payload containing an external entity referencing a local file, causing the server to return the file's contents in its response.README.md:31-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
XXE via external entity in XML deserializationThe PoC shows how an attacker can read local files (sensitive_infos.txt) by sending a crafted XML payload to a Ktor server using the vulnerable ktor-serialization-kotlinx-xml library.README.md:30-46server/src/main/kotlin/Main.kt:21-37
Patch Indication
Dependency version 2.3.5 used in build.gradle.ktsThe build file uses the patched version (2.3.5) of ktor-serialization-kotlinx-xml, consistent with the README's explanation that the vulnerability is fixed in this version.server/build.gradle.kts:22README.md:48
Review boundaries

What the analysis did not establish

  • 100 binary files were not inspected, but they are build artifacts and Gradle caches unlikely to contain exploit or scanner code.
  • Only 5 of 25 text files were included; the remaining 20 text files are omitted, but the included files (README, build script, server code) are the primary evidence-bearing files.
  • 100 binary files (e.g., compiled classes, Gradle caches) were not analyzed; their content could theoretically contain hidden behavior, but the text evidence shows no indication of such.
  • 20 additional text files were omitted from the evidence packet; their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1