CVE-2026-44578

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that both scans for and exploits CVE-2026-44578, a Next.js SSRF vulnerability. It sends crafted WebSocket upgrade requests to proxy HTTP GET requests to attacker-specified internal targets, including cloud metadata endpoints, and includes automated credential extraction chains for AWS and Azure.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script that exploits CVE-2026-44578 (Next.js SSRF) to scan targets, detect cloud providers, and extract cloud metadata/credentials. All behavior is consistent with the stated vulnerability and documented functionality. No concealed executable payload, persistence mechanism, credential exfiltration to an attacker-controlled destination, or other backdoor behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwarenext.js
Attack typesssrfcredential_extraction
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary purpose is to exploit CVE-2026-44578. It contains functions (ssrf, exploit_aws, exploit_azure) that actively send malicious requests to cause the target server to proxy to internal destinations and extract sensitive data. The banner and docstring explicitly label it as 'Scanner & Exploit', and the code includes automated credential exfiltration chains.

ynsmroztas-nextssrf-01adb79/nextssrf.py:4ynsmroztas-nextssrf-01adb79/nextssrf.py:88-118ynsmroztas-nextssrf-01adb79/nextssrf.py:219-325

Requirements

  • Target must be a self-hosted Next.js application (versions 13.4.13-15.5.15 or 16.0.0-16.2.4) using the built-in Node.js server.ynsmroztas-nextssrf-01adb79/nextssrf.py:6-7
  • Target must be reachable over the network; the exploit sends a raw HTTP request to the target host and port.ynsmroztas-nextssrf-01adb79/nextssrf.py:88-101

Observed behavior

  • Sends a crafted HTTP GET request with WebSocket upgrade headers to the target, where the request path is an attacker-controlled URL (e.g., http://169.254.169.254/latest/meta-data/). The vulnerable server proxies this request to the specified internal destination.ynsmroztas-nextssrf-01adb79/nextssrf.py:88-118
  • Automatically extracts AWS credentials by chaining multiple SSRF requests to the IMDS endpoint, retrieving instance metadata, IAM role names, and temporary security credentials (AccessKeyId, SecretAccessKey, Token).ynsmroztas-nextssrf-01adb79/nextssrf.py:219-325
  • Automatically extracts Azure managed identity tokens by requesting an OAuth2 token from the Azure IMDS endpoint.ynsmroztas-nextssrf-01adb79/nextssrf.py:327-365
  • Provides an interactive shell for manual SSRF exploration, allowing the user to send arbitrary HTTP requests through the vulnerable target.ynsmroztas-nextssrf-01adb79/nextssrf.py:369-489
  • Includes a scanning mode that detects Next.js versions, checks vulnerability status, and tests for SSRF by probing cloud metadata endpoints.ynsmroztas-nextssrf-01adb79/nextssrf.py:523-609
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Extraction
AWS IMDSv1 credential extraction (AccessKeyId, SecretAccessKey, Token) and Azure managed identity token extractionThe script extracts cloud credentials from the exploited target's metadata service and displays them to the operator. This is the intended exploit outcome for CVE-2026-44578 and does not exfiltrate credentials to a third party.ynsmroztas-nextssrf-01adb79/nextssrf.py:219-325ynsmroztas-nextssrf-01adb79/nextssrf.py:327-365
Network Connection
Connections to attacker-specified targets via SSRF (169.254.169.254, metadata.google.internal, etc.)The script sends crafted WebSocket upgrade requests to the target host, which proxies them to internal metadata endpoints. This is the core exploit mechanism described in the CVE.ynsmroztas-nextssrf-01adb79/nextssrf.py:88-118
File Write
Saves scan results and interactive session data to a local JSON/JSONL file specified by the operatorThe script writes results to a user-specified output file. No hidden or unauthorized file writes are performed.ynsmroztas-nextssrf-01adb79/nextssrf.py:712-718
Review boundaries

What the analysis did not establish

  • Only one text file (nextssrf.py) was provided; the artifact contains additional non-text media files (343,477 bytes) and unclassified files (8,625 bytes) that were not analyzed.
  • Complete artifact coverage is false; the analysis is based solely on the selected readable text file.
  • The code was not executed; classification is based on static analysis of the source code.
  • Only the single text file (nextssrf.py) was provided; no other files from the repository unit were included in the evidence packet.
  • Binary or non-text media files (if any) were flagged as metadata-only and not analyzed, though none were reported in this packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1