Dungsocool/CVE-2017-11610

GitHubRepository PoCExploit

PoC files

16 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit_supervisor.py) that exploits CVE-2017-11610 in Supervisord by sending a crafted XML-RPC request to traverse object attributes and execute arbitrary system commands via os.system. A detailed writeup (README.md) documents the full exploitation process, including reconnaissance, namespace traversal confirmation, RCE payload construction, and post-exploitation information gathering.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented proof-of-concept exploit for CVE-2017-11610 (Supervisor XML-RPC RCE) and a corresponding Python script. The README describes the vulnerability analysis and exploitation steps, and the script automates the same namespace traversal to os.system. No concealed backdoor, unrelated payload, persistence mechanism, or deceptive behavior targeting the person running the PoC was observed in the reviewed text files.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonShell
Target softwareSupervisord
Attack typesRemote Code ExecutionCommand Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a functional Python script (exploit_supervisor.py) that actively exploits CVE-2017-11610 by sending a malicious XML-RPC request to execute arbitrary commands on a vulnerable Supervisord instance. The accompanying writeup (README.md) provides a step-by-step exploitation guide and confirms successful RCE. This constitutes exploit code intended to exercise the vulnerability.

exploit_supervisor.py:4-24README.md:193-206

Requirements

  • Target must be running a vulnerable version of Supervisord (<= 3.3.2) with the XML-RPC interface exposed without authentication.README.md:53README.md:72

Observed behavior

  • The exploit script connects to the target's /RPC2 XML-RPC endpoint and sends a method call with a namespace traversal chain (supervisor.supervisord.options.warnings.linecache.os.system) to execute an arbitrary shell command.exploit_supervisor.py:10-16
  • The writeup demonstrates manual exploitation by sending crafted XML-RPC requests via curl, confirming RCE by writing the output of the 'id' command to /tmp/rce_proof.txt and verifying it inside the container.README.md:193-206
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
supervisor.supervisord.options.warnings.linecache.os.systemThe documented and scripted attack chain traverses Supervisor's internal Python object attributes to reach os.system for command execution, consistent with the published CVE-2017-11610 vulnerability.README.md:109-111exploit_supervisor.py:13
Command Execution
id > /tmp/rce_proof.txtThe README demonstrates executing the 'id' command via the XML-RPC exploit and verifying the output, proving remote code execution as the 'nobody' user.README.md:188-206
Script Behavior
exploit_supervisor.py accepts a target URL and command, then calls the same namespace traversal chain via xmlrpc.clientThe Python script automates the documented exploit without any hidden or unrelated functionality; it only performs the advertised CVE-2017-11610 exploitation.exploit_supervisor.py:1-32
Review boundaries

What the analysis did not establish

  • Evidence coverage is limited to two selected text files (README.md and exploit_supervisor.py) out of 16 total files; 14 non-text media files (images) were not analyzed.
  • The analysis is based solely on static review of the provided text; the code was not executed, and its functionality is inferred from the source code and documentation.
  • 14 non-text media files (images) were present in the repository but were not analyzed; their content could theoretically contain hidden instructions or steganographic payloads, though this is unlikely for a PoC repository.
  • Only the two text files (README.md and exploit_supervisor.py) were reviewed; other repository files (e.g., configuration, Dockerfiles) were omitted from the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1