xiaoqiMikko/bc-check

GitHubRepository PoCScanner

PoC files

19 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Java-based offline scanner that identifies Bouncy Castle artifacts in JAR/WAR files and directories, determines their product line (BC, BC-LTS, FIPS), and checks them against a hardcoded table of 37 CVE rules to report which vulnerabilities apply. It does not exploit any vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository is a Java command-line tool (bc-check) that scans local JAR/WAR files for Bouncy Castle dependencies and checks them against a hardcoded table of 2026 CVEs. All reviewed source code (README, Java classes, Python generator) performs only local file scanning, version parsing, and CVE matching. No network I/O, command execution, data exfiltration, or concealed payloads were found. The tool's behavior is consistent with its documented purpose.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesJavaPython
Target softwareBouncy Castle for JavaBouncy Castle for Java LTSBouncy Castle for Java FIPS
Attack typesCWE-295 Improper Certificate ValidationCWE-297 Improper Validation of Certificate with Host MismatchCWE-20 Improper Input Validation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a vulnerability scanner. It reads local files to detect the presence and version of Bouncy Castle libraries, then compares them against a built-in CVE database to report exposure. It does not contain any code to trigger, exploit, or demonstrate the vulnerabilities; it only checks version ranges and reports matches.

README.md:3-4src/main/java/io/mikko/bccheck/Judge.java:107-150src/main/java/io/mikko/bccheck/Main.java:41-123

Requirements

  • Java runtime (targets Java 8) to execute the JARREADME.md:155-156
  • Access to target JAR/WAR files or directories to scanREADME.md:7-8

Observed behavior

  • Scans JAR/WAR/EAR files and directories recursively to locate Bouncy Castle artifactssrc/main/java/io/mikko/bccheck/JarScanner.java:69-81
  • Identifies artifacts via MANIFEST.MF, Maven pom.properties, or filename patternssrc/main/java/io/mikko/bccheck/JarScanner.java:104-108
  • Classifies each artifact into product line (BC, LTS, FIPS) and modulesrc/main/java/io/mikko/bccheck/Coordinate.java:56-91
  • Compares detected version against a hardcoded table of 37 CVE rules to determine vulnerability statussrc/main/java/io/mikko/bccheck/Judge.java:107-150
  • Outputs a report listing matched CVEs, severity, and recommended fix versionREADME.md:89-97
  • Operates entirely offline with no network access or data exfiltrationREADME.md:3-4
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Email Address
sikongjuechen@gmail.comContact email in README for consulting services, not embedded in code or used for data exfiltration.README.md:175
Review boundaries

What the analysis did not establish

  • Evidence includes only 8 of 19 repository files; 11 files are omitted (unclassified_bytes: 67151). The missing files may include additional logic, tests, or data files not analyzed.
  • The CVE rules are hardcoded in CveTable.java, generated from tools/data/bc_cves.json, which is not included in the provided text. The accuracy of the scanner depends on the correctness of that external data file.
  • The scanner only covers 2026 CVEs; earlier CVEs are explicitly out of scope per README.md lines 127-134.
  • 11 files in the repository were not provided as text and were not reviewed, including the pre-built JAR (bc-check.jar) and binary data files. The review is based solely on the 8 provided source/documentation files.
  • The tool's behavior when processing maliciously crafted JAR files (e.g., zip bombs) is bounded by documented limits (MAX_NESTED_ENTRY_BYTES, MAX_DEPTH) but was not tested.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

4