seraphimi/ktor-xxe

GitHubRepository PoCScanner

PoC files

17 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends crafted XML payloads to a Ktor server endpoint to test for XXE (CVE-2023-45612) by checking if file contents or SSRF responses are reflected in the HTTP response. It reports vulnerability status but does not perform post-exploitation actions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md and a PoC script (poc.py) for CVE-2023-45612. The PoC script sends crafted XML payloads to a target server to test for XXE vulnerability. It performs no actions against the person running the PoC: it does not exfiltrate data, establish persistence, download or execute unrelated payloads, or conceal any operator-directed harm. The script's behavior is fully transparent and limited to the stated vulnerability testing.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareJetBrains Ktor
Attack typesXXE
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script is explicitly labeled as a scanner (line 3, line 20, line 74) and its primary operation is to send a test payload and report whether the server reflects entity content, without performing any further exploitation such as data exfiltration, command execution, or establishing persistence.

poc.py:3poc.py:20poc.py:74

Requirements

  • Target Ktor server with /xml endpoint accepting XML POST requestspoc.py:28poc.py:48-52

Observed behavior

  • Checks server availability via GET /xmlpoc.py:25-33
  • Sends XML payload with external entity referencing a local file or URLpoc.py:35-43
  • Evaluates response length and status to determine vulnerabilitypoc.py:55-66
  • Prints vulnerability status and exits with code 1 if vulnerablepoc.py:97-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Target server specified by user (e.g., http://localhost:8080)The script connects only to the user-supplied target server to send XXE test payloads. No connections to unrelated or attacker-controlled infrastructure are made.poc.py:28poc.py:48-53
Payload Generation
XML external entity injection payloadsThe script constructs XML payloads containing external entities pointing to user-specified files or URLs. This is the expected behavior for an XXE PoC.poc.py:39-43
Review boundaries

What the analysis did not establish

  • Two binary files (gradle-wrapper.jar, gradlew) are present but not analyzed; they are build/dependency artifacts and unlikely to alter the classification of the provided Python scanner.
  • Only two of 17 repository files were provided as text; the remaining 12 text files and 3 non-text files were omitted, but the included files (README.md, poc.py) are sufficient for classification.
  • Two binary files (gradle-wrapper.jar and gradlew) are present in the repository but were not analyzed; they are standard Gradle wrapper files and not part of the PoC evidence.
  • Only the README.md and poc.py files were included as text evidence; 12 other text files in the repository were omitted from the packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1