itres-labs/CVE-2023-3350

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a C# program (CVE-2023-3350.cs) that implements AES-CBC decryption using hardcoded, predictable key and IV material derived from a username. The README describes an attack chain where an unauthenticated user downloads application logs and then uses this decryption routine to recover plaintext passwords from logged ciphertext. The code is a functional decryption tool intended to exercise the cryptographic vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a C# decryption utility and a README documenting CVE-2023-3350. The code performs AES-CBC decryption of a hardcoded ciphertext using hardcoded key/IV material. No backdoor, concealed operator-directed harm, persistence, credential exfiltration, or unrelated payload is present. The artifact is a straightforward proof-of-concept demonstrating the documented cryptographic weakness.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC#Markdown
Target softwareIBERMATICA RPS 2019
Attack typescryptographic attackinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The C# file is a complete, compilable program that performs AES-CBC decryption of a hardcoded ciphertext using predictable key material. The README explicitly describes it as part of an attack chain to recover plaintext passwords. This is code intended to exercise the vulnerability, not merely detect it, making it an exploit.

CVE-2023-3350.cs:1-34README.md:45-56

Requirements

  • Obtain Base64-encoded AES-CBC ciphertext of a password from application logs.README.md:6-8README.md:47-53
  • Know the username associated with the ciphertext to derive the correct key and IV.README.md:28-30README.md:67-69

Observed behavior

  • The C# program defines a static AES-CBC decryptor with a hardcoded key and IV derived from a username pattern.CVE-2023-3350.cs:6-7
  • The Main method demonstrates decryption of a hardcoded Base64 ciphertext string and prints the resulting plaintext.CVE-2023-3350.cs:9-11
  • The DecryptAES method performs Base64 decoding and AES-CBC decryption using the static key and IV, returning the plaintext string.CVE-2023-3350.cs:14-28
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Ciphertext
Xhl[***]w==The Main method decrypts this Base64 string to demonstrate the vulnerability.CVE-2023-3350.cs:10
Hardcoded Key Material
bbbbbbbbbUSER_XX / bbbbbbbbbPASS_XXThe key and IV are hardcoded ASCII strings, consistent with the documented predictable key derivation.CVE-2023-3350.cs:6-7
Review boundaries

What the analysis did not establish

  • One file (likely a .gitignore or similar) was omitted from the text evidence; its content is not material to classification.
  • The hardcoded ciphertext in the C# file is redacted ('Xhl[***]w=='), so the exact decrypted output cannot be verified from the evidence alone.
  • One file (metadata-only) was omitted from text review; its content is unknown but flagged as non-text and not analyzed.
  • Binary content was not inspected; the review is limited to the supplied readable text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1