portbuster1337/CVE-2026-33137

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python exploit script (poc.py) that performs an unauthenticated XAR import against a vulnerable XWiki REST endpoint to create or overwrite wiki pages, and includes an RCE mode that imports pages containing Groovy/Velocity payloads to execute arbitrary commands on the target server.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script (poc.py) that exploit CVE-2026-33137 by sending a crafted XAR file to a vulnerable XWiki REST endpoint. The script performs version detection, XAR import, and optional RCE via Groovy/Velocity payloads. All behavior is consistent with the stated vulnerability and no concealed, deceptive, or unrelated harmful actions were observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareXWiki Platform
Attack typesRemote Code ExecutionUnauthenticated Document Creation/Overwrite
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the missing authorization vulnerability by constructing and sending a malicious XAR payload to the target endpoint, and includes an RCE mode that imports pages with executable code to run arbitrary commands on the server. This goes beyond detection or scanning; it exercises the vulnerability to achieve impact.

poc.py:134-168poc.py:170-239

Requirements

  • Target must be running a vulnerable version of XWiki Platform (prior to 16.10.17, 17.4.9, 17.10.3, 18.0.1, 18.1.0-rc-1).poc.py:9-10
  • The target's REST endpoint /wikis/{wikiName} must be reachable and accept POST requests without authentication.poc.py:104-111
  • For RCE, the target must allow guest viewing of pages or valid credentials must be supplied, and scripting/programming rights must be enabled for the viewing user.README.md:69-72

Observed behavior

  • Constructs a minimal XAR (ZIP) file containing a package descriptor and a document XML with attacker-controlled content.poc.py:64-73
  • Sends an unauthenticated POST request to the vulnerable REST endpoint to import the crafted XAR file, creating or overwriting wiki documents.poc.py:104-111
  • In RCE mode, imports pages containing Groovy and Velocity macros that execute a user-supplied command string on the server.poc.py:75-91
  • Attempts to trigger the imported RCE pages by requesting various REST and web UI paths, reporting which trigger paths are accessible.poc.py:198-223
  • Optionally verifies document creation by reading back the document metadata via the REST API.poc.py:158-167
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends crafted XAR file to POST /wikis/{wikiName} to create or update wiki pagesDirectly implements the described CVE-2026-33137 unauthenticated XAR import vulnerabilitypoc.py:104-111poc.py:64-73
Exploit Behavior
RCE mode imports pages with Groovy and Velocity payloads that execute a user-supplied commandMatches the documented --rce functionality; payloads are user-specified and not hardcoded to perform unrelated actionspoc.py:75-91poc.py:170-239
Network Targeting
Target URL and optional proxy are user-supplied via command-line argumentsNo hardcoded exfiltration or callback endpoints; all network activity is directed at the user-specified targetpoc.py:242-256
Review boundaries

What the analysis did not establish

  • The evidence includes only two text files (README.md and poc.py); one additional file (likely a license or similar) is omitted from the packet content, but this does not affect classification.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its actual effectiveness against a live target is not verified.
  • One file (package.xml or similar) was omitted from the text evidence but is flagged as metadata-only and not analyzed; its absence does not affect the review of the provided Python source and README.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1