Bhanunamikaze/CVE-2026-2587-Exploit-POC

GitHubRepository PoCScanner

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based validator that checks for CVE-2026-2587, an Expression Language (EL) injection vulnerability in Eclipse GlassFish. It sends benign arithmetic EL probes (e.g., #{7*7}) via the gadget handler and checks if the server evaluates them, confirming exposure without executing malicious commands.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2026-2587-Exploit-POC.py) and its README.md. The script is a proof-of-concept validator for CVE-2026-2587, a GlassFish EL injection vulnerability. It hosts benign XML canaries, sends authenticated requests to the GlassFish admin console gadget handler, and checks whether EL expressions are evaluated server-side. The code performs only the described vulnerability validation: it serves XML, makes HTTP requests, and classifies responses. No backdoor, concealed payload, persistence mechanism, credential exfiltration, or unrelated remote access behavior is present. The script's behavior is fully consistent with its stated purpose as a security testing tool.

ClassificationScanner
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareEclipse GlassFish
Attack typesExpression Language Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to detect and validate the presence of CVE-2026-2587 by sending benign probes and checking for EL evaluation. It does not execute arbitrary commands, establish reverse shells, or perform any post-exploitation actions. The README explicitly states it performs 'benign EL evaluation only — no command execution, no reverse shell, no file upload, no persistence'.

README.md:885CVE-2026-2587-Exploit-POC.py:1-5

Requirements

  • Requires a valid admin session (cookie or credentials) for the target GlassFish admin console.CVE-2026-2587-Exploit-POC.py:15-16
  • Requires a callback URL reachable by the target GlassFish server to host the benign XML probe.CVE-2026-2587-Exploit-POC.py:20-24

Observed behavior

  • Sends a GET request to the GlassFish gadget handler with a URL pointing to a hosted XML file containing EL expressions.CVE-2026-2587-Exploit-POC.py:730-737
  • Checks the HTTP response body for the evaluated result of the arithmetic expression (e.g., '49' for #{7*7}) to determine if EL injection is present.CVE-2026-2587-Exploit-POC.py:666-704
  • Classifies the target as VULNERABLE, NOT_VULNERABLE, AUTH_REQUIRED, or INCONCLUSIVE based on the response analysis.CVE-2026-2587-Exploit-POC.py:682-704
  • Supports brute-forcing common GlassFish credentials to obtain an authenticated session.CVE-2026-2587-Exploit-POC.py:402-473
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
Script starts an HTTP server to serve XML canaries and makes outbound HTTP requests to user-supplied GlassFish targets.This is the core functionality of the PoC validator and is expected for a tool that tests a server-side request forgery / EL injection vulnerability.CVE-2026-2587-Exploit-POC.py:250-295CVE-2026-2587-Exploit-POC.py:730-737
Credential Handling
Script accepts --username, --password, --cookie, and --brute arguments for GlassFish admin authentication.These are used solely to authenticate to the target GlassFish admin console for vulnerability testing. No credentials are exfiltrated; they are only sent to the user-specified target.CVE-2026-2587-Exploit-POC.py:330-348CVE-2026-2587-Exploit-POC.py:351-399
File Operation
Script can write CSV output to a user-specified file.This is a standard reporting feature for a security scanning tool. The file path is provided by the user via --csv argument.CVE-2026-2587-Exploit-POC.py:1080-1093
Review boundaries

What the analysis did not establish

  • Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 4 files were unclassified and 1 non-text media file was not inspected. The analysis is based solely on the provided Python script and README.
  • The artifact's behavior is inferred from static code analysis; the code was not executed.
  • Five files in the repository (including one non-text media file) were not included in the text evidence. Their metadata is present but content was not analyzed. The reviewed text files are the primary executable script and its documentation, which are the most relevant for backdoor analysis.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.lab.yml

Created Vuln labCVE-2026-2587Compose · images

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs a single GlassFish 7.0.15 container for validating CVE-2026-2587, an EL injection vulnerability in the admin console gadget handler.

docker-compose.lab.yml:1-10README.md:1-5

Lab assessment

Vulnerability lab

The README explicitly describes the repository as a 'Safe PoC validator for CVE-2026-2587' and provides a Docker Compose file to bring up a GlassFish instance for testing. The script performs benign EL injection probes to confirm the vulnerability.

README.md:1-5docker-compose.lab.yml:1-10
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

glassfish

vulnerable targetGlassFish application server

Runs omnifish/glassfish:7.0.15 with admin console ports 8080 and 4848 bound to localhost. The container is configured with an extra_hosts entry to allow it to reach the host's XML server for the exploit exercise.

docker-compose.lab.yml:2-9

CVE-2026-2587-Exploit-POC.py

vulnerability validatorexploit script

A Python script that serves a benign XML probe, authenticates to the GlassFish admin console, and triggers the gadget.jsf endpoint to test for EL injection. It performs only arithmetic and string canary evaluations, not command execution.

CVE-2026-2587-Exploit-POC.py:1-5README.md:1-5
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-2587

Supported by supplied evidence

The entire repository is dedicated to validating CVE-2026-2587. The README, script, and Docker Compose file all reference this CVE, and the script's behavior (sending EL expressions to the gadget endpoint) directly targets the described vulnerability.

README.md:1-5CVE-2026-2587-Exploit-POC.py:1-5docker-compose.lab.yml:1-10
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed to run the lab environment.README.md:1
  • Python 3.9+ and the 'requests' library to run the validator script.README.md:1
  • A local XML server (built into the script or a separate HTTP server) reachable from the GlassFish container to host the probe XML.README.md:1
  • Valid admin credentials or a session cookie for the GlassFish admin console.README.md:1

Evidence-described exercise path

  1. Start the GlassFish lab container using 'docker compose -f docker-compose.lab.yml up'.README.md:1
  2. Serve the benign probe XML using the script's built-in server or a separate HTTP server on port 8000.README.md:1
  3. Run the validator script with the target base URL, callback URL, and admin credentials to trigger the gadget endpoint and check for EL evaluation.README.md:1
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The script performs only benign EL canary evaluations (arithmetic and string operations) against the lab's own GlassFish container. It does not execute commands, open reverse shells, exfiltrate data, or interact with systems outside the lab. The Docker Compose file binds ports to localhost and does not use privileged mode or mount sensitive host paths.

CVE-2026-2587-Exploit-POC.py:1-5docker-compose.lab.yml:1-10
Review boundaries

What the analysis did not establish

  • The packet includes only the Docker Compose file, README, and Python script. The probe.xml and other repository files are not included in the evidence, but their absence does not affect the analysis of the lab environment.
  • The script's behavior is described in the README and source code; no runtime execution was performed to confirm exact behavior.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1