shinthink/CVE-2026-66066

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploit chain for CVE-2026-66066. It includes a Python script (cve_2026_66066.py) that performs arbitrary file read on a vulnerable Rails Active Storage instance by uploading a crafted MATLAB/HDF5 dual-identity file, recovers the SECRET_KEY_BASE, and then forges a signed variation to achieve remote code execution. The README.md documents the exploit's usage and attack flow.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a proof-of-concept exploit for CVE-2026-66066. The Python script (cve_2026_66066.py) and README.md describe and implement a legitimate exploit chain against vulnerable Rails applications. The code performs expected exploit actions: detecting Rails/ActiveStorage, uploading a crafted dual-identity file to trigger arbitrary file read, recovering SECRET_KEY_BASE, and forging a signed variation to achieve remote code execution. No concealed backdoor, unrelated payload, credential exfiltration to an attacker-controlled third party, or persistence mechanism was observed. The script's behavior is fully consistent with the stated CVE exploitation.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareRuby on Rails Active Storagelibvips
Attack typesarbitrary file readremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits CVE-2026-66066 by uploading a malicious file to read arbitrary server files and then executing arbitrary commands on the target. This is code intended to exercise a vulnerability, not merely detect it.

cve_2026_66066.py:1-10cve_2026_66066.py:130-180cve_2026_66066.py:661-704

Requirements

  • Target must be a Rails application with Active Storage using the default libvips variant processor and accepting unauthenticated direct uploads.README.md:15-16cve_2026_66066.py:7-10
  • A variation key must be harvestable from the target application (e.g., from an existing thumbnail).cve_2026_66066.py:509-518

Observed behavior

  • Detects Rails and Active Storage by checking for indicators in HTML and probing the direct upload endpoint.cve_2026_66066.py:358-393
  • Crafts a dual-identity MATLAB/HDF5 file with an external dataset pointing to an arbitrary server-side file path.cve_2026_66066.py:130-180
  • Uploads the crafted payload via the direct upload endpoint, then triggers the file read by requesting a representation URL, and decodes the resulting PNG to recover file bytes.cve_2026_66066.py:433-529cve_2026_66066.py:573-617
  • Recovers SECRET_KEY_BASE from /proc/self/environ or /proc/1/environ via the file read primitive.cve_2026_66066.py:619-641
  • Derives the Active Storage verifier key, forges a signed variation containing instance_eval with a shell command, and executes it to achieve RCE.cve_2026_66066.py:286-307cve_2026_66066.py:661-704
  • Supports mass scanning of multiple targets with concurrent threads.cve_2026_66066.py:781-812
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Arbitrary file read via crafted MAT/HDF5 upload and RCE via forged ActiveStorage variationThe script implements the full CVE-2026-66066 exploit chain as described in the README, including file read from /proc/self/environ and RCE via instance_eval.cve_2026_66066.py:573-617cve_2026_66066.py:661-704
Network Target
User-supplied target hostAll network requests are directed to the target specified by the user via -t/--target or -f/--file arguments. No hardcoded exfiltration endpoints or callbacks to attacker infrastructure are present.cve_2026_66066.py:916-917cve_2026_66066.py:360-393
Embedded Payload
Base64-encoded, zlib-compressed HDF5 templateThe script contains a pre-built HDF5 template used to construct the dual-identity file for the file-read primitive. This is a necessary component of the exploit, not a concealed malicious payload.cve_2026_66066.py:68
Review boundaries

What the analysis did not establish

  • Two files (out of five total) were omitted from the packet due to text budget constraints, but the three included files (README.md, cve_2026_66066.py, requirements.txt) provide complete coverage of the exploit logic and documentation.
  • Two files (unclassified, 1134 bytes total) were present in the repository but not included as text in the evidence packet; their content was not reviewed.
  • The review is limited to static analysis of the provided source code; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1