rxerium/CVE-2025-10035

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects vulnerable GoAnywhere MFT instances by extracting the version from the login page and comparing it against known affected ranges (>=7.7.0,<7.8.4 and <7.6.3). It does not exploit the deserialization vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Nuclei detection template (CVE-2025-10035.yaml) and a README.md file. The template performs a version-based detection of vulnerable GoAnywhere MFT instances by extracting the version from the login page and comparing it against known affected ranges. The README provides usage instructions and references. No backdoor, deceptive payload, concealed executable behavior, or operator-directed harm is present in the reviewed text.

ClassificationScanner
Model confidence100%
AuthenticationNot required
Languagesyaml
Target softwareGoAnywhere MFT
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version-based detection of a vulnerability without any exploit payload, command execution, or deserialization logic. The README explicitly describes it as a detection method.

CVE-2025-10035.yaml:1-40README.md:3-5

Requirements

  • Target must be running GoAnywhere MFT with an accessible login page.CVE-2025-10035.yaml:14-16

Observed behavior

  • Sends an HTTP GET request to /goanywhere/auth/Login.xhtml.CVE-2025-10035.yaml:14-16
  • Extracts the version string using the regex 'GoAnywhere\s+([0-9]+\.[0-9]+\.[0-9]+)'.CVE-2025-10035.yaml:18-24
  • Matches if the response body contains 'GoAnywhere Managed File Transfer' and the extracted version falls within the affected ranges.CVE-2025-10035.yaml:28-40
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2025-10035.yamlDetection template that extracts GoAnywhere MFT version from /goanywhere/auth/Login.xhtml and matches against affected version ranges (<7.6.3 or >=7.7.0,<7.8.4).CVE-2025-10035.yaml:1-40
Contact Method
Signal link in README.mdAuthor provides a Signal contact link for questions; this is a standard practice and does not constitute a backdoor or malicious behavior.README.md:44-46
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the packet; its content is not provided, but it is unlikely to contain exploit code.
  • The evidence does not include any exploit or deserialization payload; classification is based solely on the provided scanner template and documentation.
  • One file (metadata only, not analyzed) was omitted from the text evidence; its content is unknown.
  • Binary files were flagged as metadata-only and not analyzed; their content is unknown.
  • The review is limited to the supplied text evidence and does not assess the safety of external links or referenced tools.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1