infernosalex/CVE-2023-45612-PoC

GitHubRepository PoCExploit

PoC files

15 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends a crafted XML payload containing an external entity to a user-supplied Ktor endpoint, attempting to read a local file and display its contents in the response.

Backdoor review

No backdoor observed in reviewed code

The reviewed Python script (CVE-2023-45612.py) is a straightforward Proof of Concept for CVE-2023-45612 (XXE). It constructs an XML payload with an external entity pointing to a user-supplied file path and sends it to a user-supplied target URL. No backdoor, deceptive payload, or concealed operator-directed harm is present. The script's behavior is fully transparent and limited to the described exploit demonstration.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareJetBrains Ktor
Attack typesxxe
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious XML payload designed to trigger an XXE vulnerability and exfiltrate file contents, which constitutes exploitation rather than mere detection or scanning.

CVE-2023-45612.py:81-95CVE-2023-45612.py:115-119

Requirements

  • Target Ktor server with vulnerable ContentNegotiation XML configuration accepting POST requests at the specified endpoint.CVE-2023-45612.py:131-133
  • Network connectivity to the target server.CVE-2023-45612.py:97-104

Observed behavior

  • Constructs an XML payload with a DOCTYPE defining an external entity that references a local file path via file:// URI.CVE-2023-45612.py:75-95
  • Sends the XML payload via HTTP POST to the target endpoint and prints the server response, which may include the contents of the targeted file.CVE-2023-45612.py:115-125
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
XXE payload construction and deliveryThe script builds an XML payload containing an external entity referencing a user-supplied file path and sends it via HTTP POST to a user-supplied endpoint.CVE-2023-45612.py:75-95CVE-2023-45612.py:115-119
Network Communication
HTTP POST to user-supplied targetThe script sends the crafted XML payload to a target URL and endpoint provided by the user via command-line arguments.CVE-2023-45612.py:131-133CVE-2023-45612.py:144-151
User Interaction
Command-line arguments for target and file pathThe script requires the user to explicitly provide the target URL and the file path to read, making the attack fully user-directed.CVE-2023-45612.py:131-132
Review boundaries

What the analysis did not establish

  • Two binary files (gradle-wrapper.jar and gradlew) were not inspected; they are build/dependency files and do not affect the classification of the primary Python exploit script.
  • Only the two most relevant text files (CVE-2023-45612.py and README.md) were included; 12 other text files were omitted, but the included files are sufficient for classification.
  • Two binary files (gradle-wrapper.jar and gradlew) are present in the repository but are not analyzed. They are standard build tools and are not invoked by the reviewed PoC script.
  • The review is limited to the two text files provided; 12 other text files in the repository were not included in the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1