shinigami-777/PoC_CVE-2025-54887

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Ruby script that demonstrates exploitation of CVE-2025-54887 by brute-forcing a single-byte authentication tag on a JWE token encrypted with A256GCM, causing the vulnerable library to decrypt the ciphertext despite an invalid tag.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a single Ruby exploit script (exploit.rb) that demonstrates brute-forcing a single-byte authentication tag for CVE-2025-54887. The script uses standard JWE library calls to encrypt and decrypt, and iterates over 256 possible tag values to find one that decrypts successfully. No backdoor, concealed payload, persistence, credential theft, or unrelated remote access behavior is present. The code is straightforward and matches the stated PoC purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesRuby
Target softwareruby-jwe
Attack typesBrute ForceAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively modifies a JWE token's authentication tag and uses the vulnerable library to decrypt it, demonstrating a practical attack that bypasses integrity checks to recover plaintext. This is exploitation, not mere detection.

exploit.rb:13-31README.md:3

Requirements

  • Requires the vulnerable ruby-jwe gem version 1.1.0.exploit.rb:1
  • Requires a valid JWE token encrypted with the 'dir' algorithm and 'A256GCM' encryption.exploit.rb:7
  • Requires knowledge of the symmetric encryption key.exploit.rb:5

Observed behavior

  • Generates a random 32-byte key and encrypts a test string into a JWE token.exploit.rb:5-7
  • Splits the JWE token into its five components.exploit.rb:10
  • Iterates through all 256 possible single-byte values, replacing the original authentication tag with a crafted single-byte tag.exploit.rb:13-21
  • Attempts to decrypt the crafted JWE token; upon successful decryption, prints the working tag byte and the decrypted message, then stops.exploit.rb:23-31
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Brute-force single-byte authentication tag for JWE tokenThe exploit.rb script demonstrates the vulnerability described in CVE-2025-54887 by crafting a JWE token with a single-byte tag and attempting decryption until one succeeds.exploit.rb:12-31
Review boundaries

What the analysis did not establish

  • Only two of four repository files were provided as text; the other two files (likely the blog writeup and video) were omitted, so the full artifact context is incomplete.
  • The evidence coverage is 'COMPLETE_FOR_READABLE_SELECTED_TEXT', not full artifact coverage, meaning some files were not analyzed.
  • The script requires the encryption key, so it does not demonstrate a full keyless attack; it assumes the attacker already possesses the key.
  • Two files (total 3236 bytes) were classified as unclassified/binary and were not analyzed; their content is unknown but they are not part of the selected text evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1