0xBlackash/CVE-2026-66066

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a safe remote fingerprinting scanner for CVE-2026-66066. It probes a target URL for Rails and Active Storage indicators without exploiting the vulnerability. The README provides a technical writeup but the primary executable code is a scanner.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md documentation file and a Ruby script (CVE-2026-66066-SafeCheck.rb) that performs a non-exploitative remote fingerprint of a target for CVE-2026-66066. The script makes only HTTP GET requests to standard Rails paths and analyzes response headers and body content for indicators. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesRuby
Target softwareRuby on RailsActive Storage
Attack typesfingerprinting
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Ruby script explicitly states it is a 'Safe Remote Fingerprint' and 'Non-exploiting · version / fingerprint only'. It checks for the presence of Rails and Active Storage indicators via HTTP requests and response analysis, which is detection/scanning behavior, not exploitation.

CVE-2026-66066-SafeCheck.rb:3-5CVE-2026-66066-SafeCheck.rb:70-71

Requirements

  • Target URL must be provided via -u flagCVE-2026-66066-SafeCheck.rb:36

Observed behavior

  • Sends HTTP GET requests to the target base URL and specific Active Storage pathsCVE-2026-66066-SafeCheck.rb:75CVE-2026-66066-SafeCheck.rb:125-128
  • Checks response headers (Server, X-Runtime, X-Version) and body content for Rails markersCVE-2026-66066-SafeCheck.rb:78-106
  • Probes /rails/info/properties for version information exposureCVE-2026-66066-SafeCheck.rb:141-142
  • Calculates a risk score based on detected indicators and prints a verdict (HIGH, MEDIUM, LOW)CVE-2026-66066-SafeCheck.rb:155-175
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Behavior
The script performs HTTP GET requests to the user-supplied target URL and standard Rails paths (/rails/active_storage/blobs/redirect/, /rails/active_storage/blobs/, /rails/active_storage/disk/, /rails/active_storage/representations/, /rails/info/properties). It analyzes response headers (server, x-powered-by, x-runtime, x-version, x-rails-version) and body content for Rails-related strings (csrf-token, rails-ujs, data-turbo, stimulus, active.?storage). It does not upload files, execute commands, or establish persistence.The script's behavior is consistent with its stated purpose of safe remote fingerprinting and does not exhibit backdoor or trojan characteristics.CVE-2026-66066-SafeCheck.rb:48-63CVE-2026-66066-SafeCheck.rb:75-84CVE-2026-66066-SafeCheck.rb:95-106CVE-2026-66066-SafeCheck.rb:117-129CVE-2026-66066-SafeCheck.rb:141-142
Documentation Content
The README.md describes the repository as educational security research for CVE-2026-66066, providing an overview, features, repository structure, affected software, impact, detection guidance, mitigation, and a disclaimer for authorized use only.The documentation aligns with the stated defensive and research purpose and contains no instructions for malicious use or concealed payloads.README.md:19-22README.md:123-127
Review boundaries

What the analysis did not establish

  • The repository structure in README.md references docs/, detection/, screenshots/, and images/ directories that are not present in the supplied evidence packets.
  • The README.md describes a technical writeup and detection guidance, but only the scanner script and README are provided; no exploit code is included.
  • Only the two text files (CVE-2026-66066-SafeCheck.rb and README.md) were provided and reviewed. No other files from the repository (e.g., docs/, detection/, images/) were included in the evidence packet, so their contents are unknown.
  • The script disables SSL certificate verification (line 55), which is a security weakness but is a common practice in scanning tools and does not constitute a backdoor or trojan.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1