rxerium/CVE-2025-41244

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects VMware Aria Operations instances by checking for a specific response body string and HTTP 200 status, then extracts a version number and compares it to a vulnerable range (< 8.18.5).

Backdoor review

No backdoor observed in reviewed code

The repository contains a Nuclei template for detecting CVE-2025-41244 and a README with usage instructions. The template performs a benign GET request to identify VMware Aria Operations instances and extract version information. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text files.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesyaml
Target softwareVMware Aria Operations
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable VMware Aria Operations instances. It does not contain any code to exploit the vulnerability or gain elevated privileges; it only checks for the presence and version of the software.

CVE-2025-41244.yaml:1-38README.md:1-3

Requirements

  • Target URL must be reachable and respond to GET /ui/login.action?vcf=1CVE-2025-41244.yaml:14-16

Observed behavior

  • Sends an HTTP GET request to {{BaseURL}}/ui/login.action?vcf=1CVE-2025-41244.yaml:14-16
  • Extracts a version string from the response body using regex ?version=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)CVE-2025-41244.yaml:18-24
  • Matches if the response body contains 'VMware Aria Operations', the HTTP status is 200, and the extracted version is less than 8.18.5CVE-2025-41244.yaml:26-38
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
{{BaseURL}}/ui/login.action?vcf=1Target path used by the Nuclei template to probe for the vulnerable application.CVE-2025-41244.yaml:16
Regex
\?version=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)Regex used to extract the version string from the response body for version comparison.CVE-2025-41244.yaml:22
Dsl Expression
compare_versions(version, "< 8.18.5")DSL matcher that checks if the extracted version is below the vulnerable threshold.CVE-2025-41244.yaml:38
Review boundaries

What the analysis did not establish

  • One file (unclassified, 1073 bytes) was omitted from analysis; its content is unknown.
  • The artifact does not include any exploit code; it only detects potentially vulnerable versions.
  • One file (metadata only, not supplied as text) was omitted from the review; its content is unknown.
  • Binary content was not present in the supplied evidence.
  • The review is limited to the static content of the provided text files and does not include dynamic analysis or execution.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1