keraattin/CVE-2026-34197

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a detection script and documentation for CVE-2026-34197. The Python script checks for the presence of a vulnerable Apache ActiveMQ instance by probing the Jolokia API endpoint, attempting authentication, detecting the version, and verifying MBean accessibility. It does not send any exploit payload or execute commands. The README provides a technical writeup of the vulnerability and usage instructions for the scanner.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python detection script and a README documentation file for CVE-2026-34197. The Python script performs only read-only HTTP requests to check Jolokia endpoint accessibility, version detection, and MBean search queries. It does not send any exploit payloads, execute commands, or establish any backdoor access. The README describes the vulnerability and provides usage instructions for the detection script and manual verification commands. No concealed executable behavior, deceptive payloads, or operator-directed harm is present in the reviewed text.

ClassificationScanner
Model confidence98%
AuthenticationUnknown
LanguagesPythonMarkdown
Target softwareApache ActiveMQ Classic
Attack typesRemote Code ExecutionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script's primary operation is to detect and report on the vulnerability status of a target, not to exploit it. The script explicitly states 'No exploit payloads are sent. No commands are executed. The scanner only observes endpoint accessibility and version information.' in the README. The code performs HTTP GET requests for information gathering and a read-only Jolokia search, which are characteristic of a vulnerability scanner.

README.md:251CVE-2026-34197_ActiveMQ_Jolokia_detector.py:228-254

Requirements

  • Network access to the target ActiveMQ web console port (default 8161).CVE-2026-34197_ActiveMQ_Jolokia_detector.py:112
  • Python 3 with the 'requests' library installed.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:28-32

Observed behavior

  • Sends HTTP GET requests to /api/jolokia/ to check if the Jolokia endpoint is accessible without authentication.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:112-120
  • If the endpoint requires authentication (HTTP 401), attempts to authenticate using provided credentials or a list of default credentials (admin:admin, user:user, admin:activemq).CVE-2026-34197_ActiveMQ_Jolokia_detector.py:134-175
  • Attempts to detect the ActiveMQ version by scraping several web endpoints and matching version patterns using regular expressions.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:194-225
  • Performs a safe, read-only Jolokia search query to check if the Broker MBean is accessible, confirming the exploit path exists without sending any exploit payload.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:228-254
  • Calculates a risk level (CRITICAL, HIGH, MEDIUM, LOW) based on the detected version, authentication status, and Jolokia accessibility.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:266-278
  • Outputs scan results in a human-readable format and optionally saves them to a JSON file.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:283-315CVE-2026-34197_ActiveMQ_Jolokia_detector.py:386-389
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Detection Script Behavior
The Python script performs HTTP GET requests to /api/jolokia/, /admin/, and /api/jolokia/search/ endpoints to detect Jolokia accessibility and ActiveMQ version. It attempts default credentials only if a 401 is received. No POST requests, exploit payloads, or command execution are performed.Demonstrates that the script is a passive vulnerability scanner, not an exploit or backdoor.CVE-2026-34197_ActiveMQ_Jolokia_detector.py:78-280
Documentation Claim
README states: 'No exploit payloads are sent. No commands are executed. The scanner only observes endpoint accessibility and version information.'Explicitly confirms the non-exploitative nature of the provided script.README.md:251
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. One file is reported as omitted (unclassified_bytes: 6984, unclassified_file_count: 1). The analysis is based on the two provided text files.
  • The artifact's behavior is determined through static analysis of the provided source code; the code was not executed.
  • One file (likely the Nmap NSE script referenced in README.md) was omitted from the text evidence due to being unclassified or binary; its content was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1