keraattin/CVE-2026-39842

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit_openremote.py) that exploits CVE-2026-39842, an expression injection vulnerability in OpenRemote's Rules Engine. The script authenticates to a target, crafts a JavaScript payload that uses Java.type() to access java.lang.Runtime for arbitrary command execution, and delivers it via the vulnerable API endpoint to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md documentation file and an exploit_openremote.py proof-of-concept script for CVE-2026-39842. The Python script implements a standard exploit chain: authenticate to a target OpenRemote instance, craft a JavaScript payload that leverages the unsandboxed Nashorn engine to execute arbitrary OS commands, deliver the payload via the vulnerable rules API, and optionally clean up. All behavior is consistent with a legitimate security research PoC targeting the described vulnerability. No concealed executable behavior, unrelated payload delivery, credential exfiltration to an attacker-controlled destination, persistence installation, or other backdoor functionality was observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPythonJavaScript
Target softwareOpenRemote
Attack typesRemote Code ExecutionExpression Language InjectionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script 'exploit_openremote.py' is explicitly designed to exploit CVE-2026-39842. It performs the full attack chain: authentication, payload generation using Java.type() to access java.lang.Runtime for command execution, delivery to the vulnerable endpoint, and post-exploitation cleanup. The script's own description states it is a 'Proof of Concept for expression injection' and 'Exploits unsandboxed Nashorn ScriptEngine.eval() to achieve RCE as root'.

exploit_openremote.py:3-7exploit_openremote.py:154-221exploit_openremote.py:245-291

Requirements

  • Requires valid credentials for a user with the 'write:rules' role on the target OpenRemote instance.exploit_openremote.py:19exploit_openremote.py:99-136
  • Target must be running a vulnerable version of OpenRemote (<= 1.21.0).exploit_openremote.py:15exploit_openremote.py:139-151

Observed behavior

  • Authenticates to the target OpenRemote instance using Keycloak with a supplied username and password.exploit_openremote.py:99-136
  • Checks the OpenRemote version via the /api/master/info endpoint.exploit_openremote.py:139-151
  • Constructs a JavaScript payload that uses Java.type('java.lang.Runtime') to execute arbitrary OS commands via Nashorn's ScriptEngine.eval().exploit_openremote.py:154-242
  • Sends the malicious JavaScript ruleset to the vulnerable POST /api/{realm}/rules/realm endpoint.exploit_openremote.py:245-291
  • Optionally cleans up by deleting the created ruleset after exploitation.exploit_openremote.py:294-305
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The exploit_openremote.py script authenticates to a user-supplied target, creates a JavaScript ruleset containing a Nashorn expression injection payload, and triggers remote code execution.This is the expected behavior of a PoC for CVE-2026-39842. The script only interacts with the target specified by the operator and does not perform any unrelated actions.exploit_openremote.py:322-380
Payload Construction
The build_js_payload function constructs JavaScript code that uses Java.type('java.lang.Runtime') to execute shell commands.This directly matches the vulnerability description (unsandboxed Nashorn ScriptEngine.eval()). The payload is delivered to the operator-specified target and does not contain any hidden secondary actions.exploit_openremote.py:154-242
Cleanup Functionality
The script includes an optional cleanup step that deletes the created ruleset via the target API.This is a common feature in responsible PoCs to avoid leaving artifacts on the target system. It does not indicate malicious intent.exploit_openremote.py:294-305
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository were included. Two text files (README.md and exploit_openremote.py) are provided, but two additional files are omitted.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its operational behavior is inferred from its logic and comments.
  • Two additional files in the repository (detect_openremote.py and openremote-detect.nse) were listed in metadata but their content was not included in the evidence packet. Their behavior was not reviewed.
  • The review is limited to static analysis of the provided source code; no dynamic execution or network traffic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1