jozliner/CVE-2019-5392-for-Python3

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python 3 script that connects to a target, sends a crafted ASN.1 BER-encoded request to list a directory, and prints the response. It does not execute a payload or gain code execution; it only retrieves and displays directory contents, which aligns with the CVE-2019-5392 information disclosure vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2019-5392.py) and a README.md file. The script implements a proof-of-concept for CVE-2019-5392, an information disclosure vulnerability in HPE Intelligent Management Center. It connects to a target IP and port, sends a crafted ASN.1 BER-encoded payload requesting directory contents, receives the response, and prints a cleaned version of the data. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is observed. The script performs only the advertised exploit functionality.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareHPE Intelligent Management Center (IMC) PLAT
Attack typesinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script sends a request and prints the response, which is a directory listing. It does not contain any code to execute commands, drop files, or establish a shell. This is consistent with a scanner that validates the information disclosure vulnerability rather than an exploit that achieves code execution or further compromise.

CVE-2019-5392.py:1-90

Requirements

  • Target must be running vulnerable HPE IMC PLAT service on the specified port (default 2810).CVE-2019-5392.py:17
  • Network connectivity to the target IP and port is required.CVE-2019-5392.py:23-31

Observed behavior

  • Accepts target IP, port, and directory path as command-line arguments.CVE-2019-5392.py:12-18
  • Constructs an ASN.1 BER-encoded message containing a flag and the requested directory path.CVE-2019-5392.py:34-45
  • Sends the encoded message to the target and receives a response.CVE-2019-5392.py:59-62
  • Decodes and prints the received data, which is expected to be a directory listing.CVE-2019-5392.py:68-87
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
socket.connect(victim_address) to user-supplied IP and portThe script connects to a target specified by the user to send the exploit payload and receive the response, consistent with the stated CVE-2019-5392 PoC.CVE-2019-5392.py:23-31
Payload Construction
ASN.1 BER-encoded DbmanMsg with flag=1 and user-supplied directoryThe script constructs a payload matching the expected format for the CVE-2019-5392 vulnerability, using the pyasn1 library.CVE-2019-5392.py:34-51
Data Exfiltration
Received data is decoded and printed to stdoutThe script receives up to 4000 bytes from the target, decodes it, applies regex-based cleaning, and prints the result. This is the intended information disclosure of the PoC.CVE-2019-5392.py:61-87
Review boundaries

What the analysis did not establish

  • Only the Python script and README were provided; no network traffic or execution output is available to confirm the actual behavior.
  • The script's effectiveness depends on the target service's response format, which is not verified here.
  • Only the two text files (CVE-2019-5392.py and README.md) from the repository snapshot are included in the evidence. No other files, dependencies, or commit history were reviewed.
  • The analysis is static; the script was not executed, and its runtime behavior cannot be confirmed.
  • The evidence does not include the pyasn1 library or other imported modules, which could theoretically introduce backdoor behavior, but no evidence of such is present in the reviewed code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1