Ash1996x/CVE-2025-54914-PoC
PoC files
5 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a Python-based exploit for CVE-2025-54914, an Azure Networking Elevation of Privilege vulnerability. It creates malicious routes in Azure virtual networks via the Azure Management API, includes multi-target scanning, persistence mechanisms, and evasion techniques.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and two Python scripts (exploit.py, exploit_utils.py) that implement a PoC for CVE-2025-54914, an Azure Networking Elevation of Privilege vulnerability. The code performs Azure route creation, deletion, scanning, and reporting using the Azure Management API. It includes evasion techniques (random delays, user-agent rotation), persistence via Windows scheduled tasks, and multi-target scanning. All observed behavior is consistent with the stated exploit functionality and does not exhibit concealed operator-directed harm such as credential exfiltration, unrelated remote access, or delivery of an unrelated payload. No backdoor behavior was observed.
Classification basis and observed behavior
Classification basis
The code actively sends HTTP requests to the Azure Management API to create and delete routes, which constitutes exploitation of the vulnerability. The README and code comments explicitly label it as an 'exploit' and describe its purpose as creating malicious routes.
README.md:1-5exploit.py:1-5exploit.py:347-412Requirements
- Valid Azure access token (via Azure CLI or environment variable) with permissions to manage network routes.
exploit.py:313-345 - Target Azure subscription ID, resource group, VNet, and subnet names.
exploit.py:660-672
Observed behavior
- Creates a route in a specified Azure subnet by sending a POST request to the Azure Management API with a crafted payload containing an address prefix and next hop IP.
exploit.py:347-412 - Deletes a previously created route by sending a DELETE request to the Azure Management API.
exploit.py:414-466 - Scans multiple targets concurrently to check if they are accessible and potentially vulnerable.
exploit.py:204-280 - Implements evasion techniques such as random delays and user-agent rotation to avoid detection.
exploit.py:103-135 - Supports persistence mode by creating a Windows scheduled task to re-run the exploit at intervals.
exploit.py:183-202
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Windows scheduled task creation via schtasksThe PersistenceManager.create_scheduled_task method creates a scheduled task to re-run the exploit script in persistence mode. This is documented as a feature and is directly related to maintaining the exploit's route manipulation, not an unrelated backdoor.
exploit.py:183-202 - Evasion Technique
- Random delays and user-agent rotationThe EvasionManager class implements random request delays and rotating user-agent strings to avoid detection during exploit operations. This is consistent with the stated purpose of the tool.
exploit.py:103-135
What the analysis did not establish
- Two files (out of five total) were omitted from the text evidence due to size or selection rules, but the three included files (README.md, exploit.py, exploit_utils.py) provide complete coverage of the core exploit logic and documentation.
- The evidence does not include any binary or non-text files.
- Two files in the repository (total 5 files) were not included as text in the evidence packet and were not reviewed. Their content is unknown.
- The review is limited to static analysis of the provided source code; no dynamic execution or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.