keraattin/CVE-2026-33032

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A non-destructive detection tool for CVE-2026-33032 (MCPwn) that identifies vulnerable nginx-ui instances by fingerprinting the target, obtaining an unauthenticated session ID from the /mcp SSE endpoint, and sending a read-only 'tools/list' JSON-RPC request to /mcp_message to confirm the missing authentication middleware.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python detection script for CVE-2026-33032. The script performs only read-only fingerprinting and a benign tools/list JSON-RPC call to detect the vulnerability. No destructive actions, persistence mechanisms, credential exfiltration, or unrelated payloads are present. The code explicitly refuses to invoke any destructive MCP tools.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarenginx-ui
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary purpose is detection, not exploitation. The README explicitly states it is a 'Non-destructive detection tooling' (line 10) and the Python script's docstring describes it as a 'Non-destructive detector' (line 6). The code only sends a read-only 'tools/list' JSON-RPC method (line 258-262) and the README confirms it 'refuses to POST any other method and never constructs payloads for destructive tools' (lines 130-133). This is consistent with a scanner that checks for vulnerability without exercising it.

README.md:10-12detect_nginx_ui_mcpwn.py:2-7detect_nginx_ui_mcpwn.py:258-262README.md:130-133

Requirements

  • Network access to the target nginx-ui instancedetect_nginx_ui_mcpwn.py:302-321

Observed behavior

  • Fingerprints the target as nginx-ui by checking /api/settings, index HTML, and /api/system/info for identifying stringsdetect_nginx_ui_mcpwn.py:126-160
  • Opens an unauthenticated SSE connection to /mcp and extracts a sessionID from the streamdetect_nginx_ui_mcpwn.py:179-241
  • Sends a benign, read-only 'tools/list' JSON-RPC request to /mcp_message without any Authorization header to confirm the vulnerabilitydetect_nginx_ui_mcpwn.py:265-299
  • Reports the target as VULNERABLE if the /mcp_message endpoint returns 200 and a tool manifest, PATCHED if it returns 401/403, or INCONCLUSIVE otherwisedetect_nginx_ui_mcpwn.py:99-108detect_nginx_ui_mcpwn.py:360-375
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Detection Logic
The script uses only read-only MCP methods (tools/list) and explicitly refuses to call destructive tools.Confirms the artifact is a non-destructive vulnerability detector.detect_nginx_ui_mcpwn.py:20-21detect_nginx_ui_mcpwn.py:258-262
Benign Payload
BENIGN_TOOLS_LIST_PAYLOAD = {"jsonrpc": "2.0", "method": "tools/list", "params": {}}The only JSON-RPC method sent is tools/list, which is read-only and has no side effects.detect_nginx_ui_mcpwn.py:258-262
Review boundaries

What the analysis did not establish

  • One file (nginx-ui-mcpwn.nse) is omitted from the evidence; its content is not provided, so the Nmap NSE component cannot be analyzed.
  • The evidence does not include the complete artifact coverage; the packet reports 'complete_artifact_coverage: false' and one unclassified file of 6338 bytes is present but not analyzed.
  • One file (nginx-ui-mcpwn.nse) was classified as unclassified/binary and not provided as text; its content was not reviewed. The README describes it as an Nmap NSE script for the same detection purpose.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1