Dungsocool/CVE-2019-20933

GitHubRepository PoCExploit

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit_influxdb.py) that generates a forged JWT signed with an empty secret to bypass authentication in InfluxDB versions vulnerable to CVE-2019-20933, and sends authenticated queries to the target. The accompanying README.md provides a detailed walkthrough of exploiting this vulnerability against a lab target, including manual JWT crafting and post-exploitation actions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md walkthrough and an exploit_influxdb.py script that both demonstrate exploitation of CVE-2019-20933, an authentication bypass in InfluxDB. The Python script generates a JWT signed with an empty secret and sends it to the target to execute queries. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed. The script performs only the actions described in the README: JWT generation and authenticated API queries.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareInfluxDB
Attack typesauthentication bypassJWT forgery
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file exploit_influxdb.py is a standalone script that actively generates a malicious JWT and sends it to a target InfluxDB instance to execute arbitrary queries, which constitutes exploitation code. The README.md documents the same exploitation steps manually. Both artifacts are designed to exercise the CVE-2019-20933 vulnerability, not merely detect it.

exploit_influxdb.py:1-82README.md:150-241

Requirements

  • Target InfluxDB version < 1.7.6 with JWT authentication enabled and empty shared-secretREADME.md:69exploit_influxdb.py:28-29
  • Network access to the InfluxDB HTTP API (default port 8086)exploit_influxdb.py:38-40

Observed behavior

  • Generates a JWT with header {'alg':'HS256','typ':'JWT'} and payload containing a username (default 'admin') and a far-future expiration, signed with an empty HMAC-SHA256 key.exploit_influxdb.py:15-35
  • Sends an HTTP GET request to the /query endpoint with the forged JWT in the Authorization: Bearer header and a user-supplied InfluxQL query.exploit_influxdb.py:37-45
  • Prints the JSON response from the server if the query succeeds, indicating successful authentication bypass and data retrieval.exploit_influxdb.py:75-77
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Script
exploit_influxdb.pyPython script that generates a forged JWT with an empty secret and sends queries to an InfluxDB instance to exploit CVE-2019-20933.exploit_influxdb.py:1-82
Jwt Generation
HMAC-SHA256 with empty key (b'')The script explicitly uses an empty byte string as the HMAC key to exploit the CVE-2019-20933 vulnerability.exploit_influxdb.py:28-29
Target Interaction
HTTP GET to /query endpoint with Authorization: Bearer headerThe script sends the forged JWT to the target InfluxDB API to execute arbitrary queries, consistent with the documented exploit.exploit_influxdb.py:37-45
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files from a repository with 13 total files; 11 non-text media files (images) are present but not analyzed, which may contain additional context.
  • The analysis is based solely on static code review; the exploit code was not executed, and its effectiveness against a live target is not verified.
  • 11 non-text files (images, etc.) totaling 545,612 bytes were present in the repository but were not analyzed per the evidence envelope's binary policy (FLAGGED_METADATA_ONLY_NOT_ANALYZED). Their content could not be inspected.
  • Only the two text files (README.md and exploit_influxdb.py) were included in the review; other repository files were omitted from the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1