SP Page Builder Unauthenticated RCE

[danangrismanto255-spec]

Is there an existing template for this?

• I have searched the existing templates.

Template requests

• CVE-2026-48908
• Remote Code Execution

Anything else?

PoC:
-Unauthenticated RCE PoC for CVE-2026-48908 — SP Page Builder for Joomla (≤ 6.6.1): arbitrary file upload via asset.uploadCustomIcon.
https://github.com/papageo75/CVE-2026-48908-PoC
-https://github.com/ogenich/CVE-2026-48908/

[danangrismanto255-spec]

@pussycat0x @omarkurt @DhiyaneshGeek @ywh-jfellus please make this YAML Templates !

[DhiyaneshGeek]

Hi @danangrismanto255-spec

i'm looking into this right now , will create nuclei template for the same

Thanks for raising the issue !

[ywh-jfellus]

⚠️ The second poc (hxxps://github.com/ogenich/CVE-2026-48908/) ships malware... beware of not installing the requirements.txt.

Despite not yet flagged on PyPi, the frint and skytext dependencies (frint depends on skytext) ships native code in gradient.so that contains highly suspicious PyInit_xxx hook (persistence, obfuscation and anti-sandbox behaviors briefly spotted by our team)

I'll keep you posted with the full analysis once published ;)

Thanks for the lead @danangrismanto255-spec ❤️

[ywh-jfellus]

Short (AI summarized :)) summary of github.com/ogenich/CVE-2026-48908 supply chain attack:

PyPI supply-chain malware: frint/skytext targeting security researchers via fake CVE PoC

Summary

Two malicious PyPI packages — frint 0.1.2 and skytext 1.1.0 — ship a compiled Python
C-extension dropper (gradient.pyd on Windows, gradient.so on Linux) disguised as a
"Blazing-Fast Colored Terminal Output" library. The packages are pushed through a fake PoC
repository (github.com/ogenich/CVE-2026-48908) that instructs security researchers to
pip install frint. frint pulls skytext as a dependency; skytext carries the malicious
extension.

(we have reported both packages to PyPI)

---

How it is shipped

Layer	Detail
Lure	Fake GitHub PoC repository ogenich/CVE-2026-48908 with a ready-to-run exploit_poc.py
Package	pip install frint → transitive dep skytext 1.1.0
Payload binary	skytext/gradient.pyd (Windows) / gradient.so (Linux), exported entry PyInit_gradient
PyPI author	faberhun / faberhun@gmail.com

The extension module shadows a decoy gradient.py, so import skytext silently executes
the compiled dropper.

---

Stages

Stage 0 — Environment gate (anti-sandbox, anti-analysis)

PyInit_gradient performs PEB walking + export hashing (no imports visible in the PE
header). It runs two anti-debug checks (CheckRemoteDebuggerPresent, hardware breakpoints via
Dr0–Dr3). It then enumerates sys.modules, hashes every module's __file__ basename, and
aborts unless exactly one basename hashes to the magic constant (0xF4835C8C on Windows /
0x3c4b7527 on Linux). That basename — EXPLOIT_POC.PY — is simultaneously the selector
and the XOR decryption key. The payload is completely inert in any environment that does not
have the lure PoC script loaded (e.g., sandboxes, CI, random users).

Stage 1 — Drop & persistence

When the gate passes, five zlib-compressed, XOR-encrypted blobs are decrypted and dropped
into Python's site-packages:

• A trojanized _distutils_hack/__init__.py (genuine setuptools code + appended re-spawner)
• A malicious distutils-precedence.pth line
• choco.py — the stage-2 downloader

All dropped files are timestomped to match legitimate setuptools timestamps.
Persistence mechanism: setuptools automatically imports _distutils_hack on every Python
interpreter startup via distutils-precedence.pth.

Stage 2 — Stealthy re-spawn + C2 fetch (choco.py)

On the next interpreter launch, the patched .pth re-spawns Python hidden
(CREATE_NO_WINDOW / subprocess.Popen) using two environment-variable markers to prevent
recursion (ZEBUWIAKGPHOQAP006, JKHWQVEKRASDF12). choco.py then:

1. Silently pip install requests if needed.
2. Resolves the C2 host via DNS-over-HTTPS (Cloudflare / AliDNS).
3. Fetches a Mapbox dataset feature used as a dead-drop C2 (api.mapbox.com), reads the
   base64url-encoded payload from properties[<feature-id>].
4. exec()s the payload — arbitrary stage-3 RCE.

Stage 3 — Full-featured RAT

The Mapbox dead-drop payload is a Python RAT (final-stage-py) that registers each victim as a new Mapbox dataset ({user}_{host}_{rand5}) and uses dataset features as an encrypted command channel (AES-CBC keyed on the feature ID, with XOR fallback).

On first beacon, it immediately:

• Runs a recon sweep (ipconfig/ip a, tasklist, shell/browser history, disk layout, public IP, netstat) and uploads the result as hola.txt.gz.
• Launches a parallel thread (exf) that walks /home, /root (Linux) or all drives (Windows), collects .md, .txt, and SQLite .db files under 4 MB, packages them into an AES-256-ECB + RSA-OAEP-encrypted tar.gz, and POSTs them in 64 MB chunks to the exfil server.

Persistent C2 command set:

Command	Action
hola	Re-run full system recon
python <b64>	exec() arbitrary Python (output captured)
cmd <shell>	Run arbitrary shell command
get <path>	Upload file or zipped directory
dormir <s>	Adjust beacon sleep interval (≥ 30 s)
browserdata	Steal Chrome/Brave/Edge/Firefox cookies, saved passwords, autofill, history

Victim state is persisted in HKCU\SOFTWARE\Python\PythonCore → UUID (Windows) or ~/.daemon (Linux). A file-lock mutex prevents duplicate instances.

---

Connection to the prior mongobleed / MDUT campaign

A previous campaign used the same playbook to target researchers interested in hot CVEs of
the moment: mongobleed (CVE-2025-14847), react2shell
(CVE-2025-55182 + CVE-2025-66478), and FortiWeb (CVE-2025-64446 + CVE-2025-58034). Three fake PoC
repositories by lincemorado97 instructed victims to install slogsec, a package with
functionally identical behavior (Mapbox dead-drop downloader, hidden exec()).

both campaigns use the exact same Mapbox feature key
dm370543acmdopk296nahbtua as the C2 dead-drop, strongly suggesting shared infrastructure or
the same threat actor. Only the Mapbox account/dataset differs (mattallahsaed/... vs.
frankley/...).

Pattern: fake "CVE PoC" repo → malicious PyPI dep → compiled dropper → Mapbox dead-drop RCE.
The target is security researchers or practitioners who runs untrusted PoC code.

Reference: prior campaign analysis (zh-CN)

EDIT: https://github.com/ogenich/CVE-2026-10520 ("CVE-2026-10520 — Ivanti Sentry Mass Scanner") also ships skytext malware dependency.

---

IOCs

Malicious packages

Package	Version	SHA-256 (wheel)
skytext	1.1.0	93739477cd379adef95126b22758c0e644282d2028dd297328ce856fa111dd06
frint	0.1.2	17997e9e0256d0f5d5d21a4852c37f16b338e4bb9c2bec09bdfd822b24aa76b4

Malicious binaries

File	SHA-256
gradient.pyd (Windows)	40569318e89db751ff3886b2617d990d8a343f0d1d8727b7f978a28129ca36bc
gradient.so (Linux)	320b29844892e3c59bc6fcb07e701b2b3230a37cb4a13176174e9e294ec6d43e

Lure / distribution

• GitHub repo: github.com/ogenich/CVE-2026-48908

Dropped files (in site-packages)

• _distutils_hack/__init__.py (trojanized, timestomped)
• distutils-precedence.pth (malicious bootstrap line, timestomped)
• choco.py (stage-2 downloader, timestomped)

Network — C2 (Mapbox dead-drop)

• https://api.mapbox.com/datasets/v1/frankley/cmor0tcxf008i1mmpd7apt903/features/dm370543acmdopk296nahbtua?access_token=pk.eyJ1IjoiZnJhbmtsZXkiLCJhIjoiY21vNzFzaXNz[...]JscnlpYSJ9.fuMfMgsxlOGxRy44A-y0WQ
• Mapbox account: frankley; dataset: cmor0tcxf008i1mmpd7apt903; feature key: dm370543acmdopk296nahbtua

Network — prior campaign (shared feature key, different account)

• Mapbox account: mattallahsaed; same feature key: dm370543acmdopk296nahbtua
• Prior lure repos: lincemorado97/CVE-2025-64446_CVE-2025-58034, lincemorado97/CVE-2025-55182_CVE-2025-66478, lincemorado97/CVE-2025-14847
• Prior malicious package: slogsec

Host / behavioral

Indicator	Value
Env marker 1	ZEBUWIAKGPHOQAP006=PTsjBGKQUxZorq2
Env marker 2	JKHWQVEKRASDF12=JKHKJ23VAS8DF9
Process	python.exe child spawned with CREATE_NO_WINDOW (flag 0x08000000)
Importable module	choco present in site-packages

Network — Stage 3 exfil server

• hxxp://91[.]132[.]163[.]78:8001/assets/static/bundle[.]ext[.]min[.]de5b2bc9[.]js (chunked upload endpoint)

Network — Stage 3 C2 (Mapbox dead-drop, new account)

• Mapbox account: james09790
• Mapbox API token: sk[.]eyJ1IjoiamFtZXMwOTc5MCIsImEiOiJjbWoxM3JuNHQ[...]WhsMnVyaDZwIn0[.]ELpete7yVGAeg52Mrmt2DA
• Domain (b64-encoded in payload): api[.]mapbox[.]com

Host / behavioral — Stage 3

Indicator	Value
Bot-ID store (Windows)	HKCU\SOFTWARE\Python\PythonCore value UUID
Bot-ID store (Linux)	~/.daemon
Mutex lock dir (Linux)	~/.local/share/<md5-of-hostname>
Mutex lock dir (Windows)	%TEMP%\<md5-of-hostname>

RSA public key (Stage 3 exfil encryption)

MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtctH5Bk1nM/Jnp6UUsnC
jymtKzujqWF3ljJi12z529AvQjSUrodCc14h4v40zPXZ72SkKiEEaoHhOYA56uaC
...

Detection / hunting hashes (for YARA / binary signatures)

• Export-hash seed: 0x1D4E; algo: h = ((4*h*c) ^ h) + 1 over upper-cased name
• kernel32.dll name hash: 0xA4624E7E
• Key-selector hash constant: 0xF4835C8C (Windows) / 0x3c4b7527 (Linux)
• CheckRemoteDebuggerPresent hash: 0x65E68A20
• GetThreadContext hash: 0xD7B5F0CE

[VixianSchool]

I've submitted a template for this issue in PR #16474.

/attempt

[danangrismanto255-spec]

@VixianSchool can u make the templates to upload file or execute ?

[ywh-jfellus]

About the supply chain malware of the 2nd PoC, here is YesWeHack's full report on it : https://www.yeswehack.com/fr/news/chocopocs-vulnerability-researchers-trojanised-exploits

Hope it'll help the community, feel free to ask for or bring new intel on it ❤️