[GitHub] cve-scanner

Rce

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

RCE CVE(≧9.0) scanner

# cve-scanner

Fingerprint-driven blind CVE scanner: first identify Web / service fingerprints, and only run CVE/vulnerability exp mapped to matched components. Falls back to full blind scanning when application fingerprint is not recognized. Automatically detects targets and verifies actual command execution (RCE).
**All targets use real Docker images, no mocking.**

---

## Fingerprint-driven workflow

```
target ──► fingerprint.Detect()
│
├─ Hit application fingerprint (WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...)
│ └─► Only execute CVE exp mapped to that component (+ generic leak detection)
│
├─ Only hit weak Web service fingerprint (nginx/Apache/PHP/Node.js)
│ └─► Treat as unrecognized, execute full exp blind scanning
│
└─ No fingerprint matched
└─► Full exp blind scanning
```

### Secondary fingerprint expansion during collection

All exp requests go through the same collector (`internal/capture`):

1. First round `fingerprint.Detect()` (`bb` as `QuickDetect`) gets baseline fingerprint;
2. Each exp / detection response is re-matched for fingerprints (`fingerprint.ObserveResponse`);
3. When new components appear beyond baseline (e.g., WebLogic / Struts2 / Shiro / Tomcat not recognized initially but exposed in later exp responses), immediately merge into fingerprint and continue executing exp mapped to that component; deduplication of already executed detections via `ran` set;
4. Both `bb` and `scan` follow this workflow; collection results from `scan` are also the payload source for smuggling replay.

### Smuggling replay after zero success (second pass)

When `bb` completes normal scanning with **0 findings** and `scan` has **0 PASS globally (no actual command output)**, automatically enter second pass:

1. Collector has recorded each actual exp request (method / path / headers / body) and direct response from this round;
2. For each target, first confirm CL.TE / TE.CL channel with limited TE obfuscation combinations;
3. Replay all collected payloads **completely** through the channel one by one (deduplicate by request, no longer limit count);
4. Smuggling response shows RCE features absent in direct response → `CRITICAL`; only confirm channel and successful delivery → `HIGH`;
5. Smuggling response is also subject to fingerprint identification: if new component is exposed, supplement running exp mapped to that component.

Supports http/https; automatically skip if no payload available for replay (e.g., only ran GET probes). `scan` mode has been integrated with the same collector, smuggling replay results written to result file as `CVE=SMUGGLING-REPLAY`.

Built-in fingerprint library references matching methods from webanalyze / Wappalyzer (response headers, Server, Set-Cookie, title, body features + deep probing for WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer / OFBiz / Solr), pure standard library implementation, no third-party dependencies. Component → CVE mapping see [internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go).

View fingerprints separately:

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## Supported vulnerabilities

| CVE | Component | Protocol | CVSS | Affected versions | Port | id | whoami | hostname | pwd |
|-----|-----------|----------|------|-------------------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

RCE CVE（≧9.0） scanner

# cve-scanner

指纹驱动的盲测 CVE 扫描器：先识别 Web / 服务指纹，命中组件只跑该组件映射的 CVE/漏洞 exp，
识别不到应用指纹时回退全量盲测。自动检测目标并验证真实命令执行（RCE）。
**全部靶场使用真实 Docker 镜像，无 mock。**

---

## 指纹驱动流程

```
target ──► fingerprint.Detect()
│
├─ 命中应用指纹（WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...）
│ └─► 只执行该组件映射的 CVE exp（+ 通用泄露探测）
│
├─ 仅命中 Web 服务弱指纹（nginx/Apache/PHP/Node.js）
│ └─► 视为未识别，执行全量 exp 盲测
│
└─ 未命中任何指纹
└─► 全量 exp 盲测
```

### 采集中途的指纹二次扩展

所有 exp 请求都经过同一个采集器（`internal/capture`）：

1. 首轮 `fingerprint.Detect()`（`bb` 为 `QuickDetect`）得到 baseline 指纹；
2. 每条 exp / 探测响应都会被重新做一次指纹匹配（`fingerprint.ObserveResponse`）；
3. 出现 baseline 之外的新组件（例如首次访问没识别到、但后续 exp 响应暴露的
WebLogic / Struts2 / Shiro / Tomcat 等），立即合并进指纹并继续执行该组件映射的
exp；已执行过的探测由 `ran` 集合去重；
4. `bb` 与 `scan` 都走这套流程；`scan` 的采集结果同时是走私回放的 payload 来源。

### 零成功后的走私回放（第二遍）

`bb` 正常扫描完且 **0 findings**、`scan` 全局 **0 个 PASS（无真实命令回显）** 时，自动进入第二遍：

1. 采集器已记录本轮实际发送的每个 exp 请求（method / path / headers / body）及直连响应；
2. 对每个目标先用限定的 TE 混淆组合确认 CL.TE / TE.CL 通道；
3. 把采集到的 payload **全部**经通道逐条重放一次（按请求去重，不再限制条数）；
4. 走私响应出现直连响应中没有的 RCE 特征 → `CRITICAL`；仅确认通道并成功投递 → `HIGH`；
5. 走私响应同样会被指纹识别：若暴露了新组件，再补跑该组件映射的 exp。

支持 http/https；无 payload 可回放（如只跑了 GET 探测）则自动跳过。`scan` 模式已接入
同一采集器，走私回放结果以 `CVE=SMUGGLING-REPLAY` 写入结果文件。

内置指纹库参考 webanalyze / Wappalyzer 的匹配方式（响应头、Server、Set-Cookie、title、
body 特征 + WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer /
OFBiz / Solr 深度探测），纯标准库实现，无第三方依赖。组件 → CVE 映射见
[internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go)。

单独查看指纹：

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## 支持漏洞

| CVE | 组件 | 协议 | CVSS | 受影响版本 | 端口 | id | whoami | hostname | pwd |
|-----|------|------|------|-----------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

References

https://github.com/hktalent/cve-scanner

[GitHub] cve-scanner

Description

References

Community Rating

Quick Actions

Related Exploits