0xBlackash/CVE-2026-8451

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Ruby script that sends crafted SAML requests to a NetScaler endpoint to trigger a memory overread and extract leaked process memory from the response cookie.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Ruby script that sends crafted SAML requests to a target NetScaler endpoint and attempts to parse leaked memory from the response. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The script only interacts with the user-supplied target and prints results locally.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesRuby
Target softwareNetScaler ADCNetScaler Gateway
Attack typesmemory disclosureout-of-bounds read
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Ruby script actively sends malicious payloads to a live target to trigger a memory overread and exfiltrate leaked memory, which constitutes exploitation rather than mere detection or scanning.

CVE-2026-8451.rb:39-93CVE-2026-8451.rb:1-3

Requirements

  • Target must be a NetScaler ADC or Gateway configured as a SAML Identity Provider (IdP).README.md:93
  • Target must have the vulnerable /saml/login endpoint accessible over HTTPS.CVE-2026-8451.rb:49

Observed behavior

  • Sends multiple POST requests to /saml/login with a Base64-encoded SAML AuthnRequest containing increasing amounts of padding.CVE-2026-8451.rb:26-28CVE-2026-8451.rb:44-51
  • Extracts the NSC_TASS cookie from the HTTP response, Base64-decodes it, and searches for known SAML markers to locate leaked memory.CVE-2026-8451.rb:56-64
  • Prints a hexdump and ASCII preview of the leaked memory bytes when a leak exceeding 30 bytes is found.CVE-2026-8451.rb:74-79
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
HTTPS POST to user-supplied target URI at /saml/loginThe script sends a SAMLRequest parameter to the target to trigger the memory overread vulnerability. This is the expected behavior for a PoC exploiting CVE-2026-8451.CVE-2026-8451.rb:49-53
Data Extraction
Parses NSC_TASS cookie from response and decodes Base64 contentThe script extracts a specific cookie set by the target, decodes it, and searches for known markers to identify leaked memory. This is consistent with exploiting a memory disclosure vulnerability.CVE-2026-8451.rb:56-72
Local Output
Prints hexdump and ASCII preview of leaked data to stdoutThe script displays the leaked memory content locally for the operator. No exfiltration to an external server occurs.CVE-2026-8451.rb:74-79
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code and README; no runtime output or network capture is provided to confirm successful exploitation.
  • The script disables SSL certificate verification (VERIFY_NONE), which may mask connection issues but does not affect classification.
  • No binary or non-text files were present in the artifact.
  • The review is limited to the static source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1