1337rokudenashi/CVE-2017-5871

GitHubRepository PoCScanner1337rokudenashi/Odoo-leq-8.0-20160726-and-9.0-Open-Redirect

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that sends HTTP GET requests to Odoo endpoints with a redirect parameter and checks the Location header for a match, detecting the CVE-2017-5871 open redirect vulnerability without exploiting it.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a Nuclei template for CVE-2017-5871, an open redirect vulnerability in Odoo. The template defines HTTP requests and a regex matcher to detect the vulnerability. No executable code, obfuscation, or deceptive behavior is present. The file is a straightforward proof-of-concept detection template.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAML
Target softwareOdoo
Attack typesopen redirect
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that sends crafted requests and matches response headers to detect an open redirect vulnerability. It does not contain code to exploit the vulnerability (e.g., to steal credentials or perform phishing), only to identify its presence, which is characteristic of a scanner.

README.md:5-48

Requirements

  • Target must be running a vulnerable Odoo instance (<= 8.0-20160726 or 9.0) with the /web/session/logout or /web/dbredirect endpoints exposed.README.md:1README.md:38-40

Observed behavior

  • Sends HTTP GET requests to paths like /web/session/logout?redirect=https://oast.me and /web/dbredirect?redirect=https%3a%2f%2foast.me%2f.README.md:36-40
  • Checks the response Location header using a regex to see if it redirects to a host containing 'oast.me'.README.md:43-47
  • Stops after the first matching request.README.md:42
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2017-5871The file contains a YAML-based Nuclei template for detecting an open redirect vulnerability in Odoo.README.md:5-48
Url
https://oast.meThe template uses oast.me as a test redirect target, which is a common out-of-band testing service for vulnerability scanners.README.md:38-40
Review boundaries

What the analysis did not establish

  • Only the README.md file is provided; no other repository files (e.g., template YAML file) are included.
  • The analysis is based solely on the text content of the README; the actual Nuclei template file is not present in the evidence packet.
  • The artifact's behavior is inferred from the documented template; no execution or dynamic analysis was performed.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot.
  • The digest line (line 48) is a hash and was not decoded or analyzed for hidden content, but its presence in a public template is typical for integrity verification.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1