Add GHSA-8rcq-7w87-h64j PoC - #10
Conversation
|
Thanks! Will test. |
|
Oops! I think I got confused here and did some re-work: Which PR should we keep? |
|
Thanks for this, and apologies it sat open so long. Security PoCs have moved out of this repo. Published ones now live in deskflow/security, and work on unpublished advisories goes in a private repo so that an open PR does not disclose a working exploit before there is a fix. Your script has been ported across as deskflow/security#3, with your authorship preserved via One thing to flag: there is a second PoC for the same CVE in deskflow/security#2, so only one of the two will merge. Yours covers more variants, including the odd-length Closing here in favour of the port. |
Ported from deskflow/scripts#10 by manop55555. Renamed to the repo naming convention and the GHSA reference supplemented with the assigned CVE-2026-65832, published 2026-07-03. Co-authored-by: manop55555 <109808848+manop55555@users.noreply.github.com>
Deskflow ships with TLS on, so a plaintext-only PoC could only verify a non-default configuration. Adds --cert/--key with --no-tls to opt out, ported from the alternative PoC in deskflow/scripts#10. Also guards the handshake and trigger sequence so a peer disconnecting early exits 2 (inconclusive) instead of raising, which kept the exit-code contract from holding. Co-authored-by: manop55555 <109808848+manop55555@users.noreply.github.com>
|
Thank you too : ) |
2 participants
Adds a Python proof-of-concept for GHSA-8rcq-7w87-h64j to assist with issue reproduction and verification.