stefan-500/ktor-cve-2023-45612-poc

GitHubRepository PoCScanner

PoC files

19 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a proof-of-concept repository for CVE-2023-45612, an XXE vulnerability in Ktor. The primary code provided is an XML payload (xxe-demo-file.xml) and a secret file (secret.txt) used to demonstrate the vulnerability. The README describes how to run a vulnerable Ktor server and send the payload using curl, which would read the secret file and display its contents. The artifact does not contain any exploit code that automatically exercises the vulnerability; it provides a payload and instructions for manual testing, functioning as a vulnerability scanner/demonstrator.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a sample secret file, and an XXE payload XML. The README documents a known CVE-2023-45612 proof-of-concept, describes standard XXE exploitation steps, and provides prevention guidance. The XML payload and secret file are benign demonstration resources. No backdoor, trojan, or deceptive behavior is observed in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesXMLMarkdown
Target softwareJetBrains Ktor
Attack typesXXE
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides an XML payload and instructions for manually sending it to a vulnerable server to observe the XXE behavior. It does not include any code that automatically sends the request or exploits the vulnerability; it only demonstrates how to check for the vulnerability. This matches the definition of a scanner: code that checks for a vulnerability without exploiting it.

README.md:1README.md:8README.md:40-41README.md:61-63

Requirements

  • A vulnerable Ktor server (version < 2.3.5) with XML ContentNegotiation enabled must be running.README.md:8README.md:14
  • The attacker must be able to send HTTP POST requests to the server's /xml endpoint.README.md:40

Observed behavior

  • The README instructs the user to send an XML payload containing an external entity reference to a local file (exploit/etc/secret.txt) via curl to the /xml endpoint.README.md:61-63
  • The XML payload defines an external entity 'xxe' pointing to 'exploit/etc/secret.txt' and references it in the document body.exploit/payloads/xxe-demo-file.xml:1-2
  • The expected vulnerable result is that the server console outputs the contents of the secret file.README.md:65-66
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2023-45612The artifact is a proof-of-concept repository for a known XXE vulnerability in Ktor. The README explicitly states this and links to the CVE.README.md:1
Xxe Payload
<!DOCTYPE Mail [ <!ENTITY xxe SYSTEM "exploit/etc/secret.txt"> ]>\n<Mail><title>&xxe;</title></Mail>The XML payload is a standard XXE demonstration file that references a local file (exploit/etc/secret.txt) to illustrate the vulnerability. It does not contain any backdoor or malicious logic.exploit/payloads/xxe-demo-file.xml:1-2
Sample Secret File
SECRET_TOKEN=demo-123\nDB_PASSWORD=Password!The secret.txt file contains placeholder credentials used as a target for the XXE demonstration. It is not a real secret and does not indicate any backdoor behavior.exploit/etc/secret.txt:1-2
Review boundaries

What the analysis did not establish

  • The repository contains a binary file (gradle-wrapper.jar) that was not analyzed.
  • Only 3 of 19 files were provided as text; the remaining 16 files (including potential source code for the Ktor server) were omitted.
  • The evidence does not include the actual Ktor server source code, so the vulnerable configuration cannot be verified.
  • One binary file (gradle-wrapper.jar, 45457 bytes) was flagged but not analyzed. It is a standard build tool component, but its contents were not inspected.
  • 13 unclassified files and 2 non-text media files were not included in the text analysis. Their contents are unknown.
  • The review is limited to the supplied evidence packets and does not verify the behavior of the application at runtime.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1