DEV Community: Anuththara Wickramasekara

CVE-2026-20127 Defensive Companion

Anuththara Wickramasekara — Sun, 12 Jul 2026 04:29:34 +0000

This is a submission for Weekend Challenge: Passion Edition

What I Built

CVE‑2026‑20127 Defensive Companion - a fully offline, enterprise‑grade browser extension (Manifest V3) that transforms raw exploit intelligence into a real‑time threat analysis laboratory. It provides deep‑dive visibility into the authentication bypass vulnerability in Cisco Catalyst SD‑WAN Controllers (vSmart), enabling SOC teams and defensive researchers to dissect the DTLS handshake flaw, extract Indicators of Compromise, and deploy mitigation strategies without ever exposing operational data to external networks.

The extension delivers:

An offline NLP knowledge engine that answers natural‑language queries about the vulnerability, detection, and remediation - powered entirely by 17 segmented JSON intelligence domains parsed from the original exploit research.
An interactive Protocol Explorer that renders the legitimate vs. exploited DTLS handshake sequences, highlighting the exact memory corruption in vbond_proc_challenge_ack_ack() at 0x38AB7.
A Packet Anatomy Viewer breaking down the forged CHALLENGE_ACK_ACK message byte‑by‑byte.
A report generator that compiles on‑demand Markdown threat summaries for downstream distribution.
Strict air‑gapped design: zero external API calls, rigid Content Security Policy, and the minimal possible permissions (activeTab, sidePanel, storage).

The goal was to encapsulate months of passion for reverse engineering and defensive research into a single, elegant tool that makes sophisticated protocol analysis accessible to every security professional - anywhere, with no cloud dependency.

Demo

The extension’s side panel is the persistent analyst workspace. Below is a capture of the dashboard showing the interactive protocol explorer, local assistant, and IOC extraction.

Visual walk‑through: left pane - protocol sequence diagram with the vulnerable state transition highlighted; right pane - offline NLP assistant answering a detection query; bottom bar - quick IOC summary (malicious verify_status byte, targeted ports, anomalous log patterns).

Code

anuththara2007-W / CVE-2026-20127-Exploit-Extension

Executive Summary

The CVE-2026-20127 Defensive Companion is a premier, enterprise-grade Browser Extension engineered for proactive threat intelligence and defensive analysis. This tool encapsulates authoritative technical research concerning the authentication bypass vulnerability in the Cisco Catalyst SD-WAN Controller (vSmart). By delivering an offline, heavily localized intelligence layer, it empowers Security Operations Centers (SOC) and defensive researchers to rapidly analyze packet structures, trace authentication flows, and instantly extract Indicators of Compromise (IOCs) without exposing active investigative data to external networks.

Technical Background

The Cisco Catalyst SD-WAN architecture relies on the vdaemon service to establish and maintain control-plane DTLS connections between edge devices and the controller. The underlying vulnerability (CVE-2026-20127) exploits a failure in state machine validation during the DTLS handshake sequence, explicitly impacting ports typically associated with vSmart control traffic (e.g., 12346, 52521). The vulnerability allows unauthorized actors to bypass X.509 certificate validation and forge an authenticated state within the internal controller…

View on GitHub

How I Built It

The Spark

Cisco’s disclosure of CVE‑2026‑20127 - an unauthenticated DTLS handshake bypass in the vSmart controller’s vdaemon service - immediately ignited my passion. A single missing state‑machine check in the vbond_proc_challenge_ack_ack() function allowed an attacker to forge an authenticated session without ever presenting a valid certificate. The original exploit repository laid bare the raw mechanics; I wanted to turn that knowledge into a defensive force multiplier that would outlive the patch cycle.

This challenge provided the perfect forcing function. In one weekend, I built an extension that doesn’t just describe the vulnerability - it teaches the protocol weakness, arms defenders with live detection rules, and does so in a completely offline package that respects the operational security of the most sensitive environments.

Architecture: Isolated Intelligence, Maximum Impact

The extension adheres to the strict separation enforced by Manifest V3, while delivering a reactive, near‑instant experience.

Data Layer (src/knowledge)
The raw exploit research was parsed into 17 domain‑specific JSON objects covering everything from the DTLS state machine (message types 8,9,10) to IOC fingerprints in vsyslog and auth.log. This structured intelligence is the foundation of the offline engine.

Offline NLP Engine (src/services)
A custom, zero‑latency pipeline runs entirely in the browser:

Tokenization & stop‑word removal on the user’s natural‑language query.
Heuristic intent detection - mapping phrases like “how to detect” to the Detection knowledge domain.
Semantic retrieval against the pre‑built inverted index (a Set<string> intersection over tokens).
Template‑driven synthesis that assembles the matched JSON fragments into human‑readable Markdown, complete with memory addresses, log signatures, and ACL recommendations.

All indexing happens synchronously at side‑panel load, keeping query response times sub‑millisecond.

Presentation Layer (React 19 + Vite + Tailwind)
The UI is built as a single‑page application mounted in the sidePanel. Key design choices:

Lazy‑loaded components ensure instant first paint; the Protocol Explorer and Packet Viewer are loaded only when their tabs are activated.
Framer Motion hardware‑accelerates the DTLS sequence animations, making the state‑transition attack path intuitively visible.
Lucide React provides a professional icon set that scales across Chrome’s light/dark modes.

Browser Integration

A service worker (background.ts) acts as the central event bus, routing messages between the popup, side panel, and storage layers with mandatory return true for async chrome.runtime.onMessage listeners.
chrome.storage.local persists user preferences and the most recent report snapshot.
The manifest requests only activeTab, sidePanel, and storage - no webRequest, no declarativeNetRequest. All intelligence is self‑contained; the tool makes zero network requests, guaranteeing that no sensitive investigation data leaks.

Technical Deep Dive: Why the Vulnerability Exists

The extension’s Protocol Explorer visualises the core flaw. In the legitimate flow:

Client sends DTLS ClientHello with X.509 cert.
Server issues CHALLENGE (msg_type=8).
Client responds CHALLENGE_ACK (msg_type=9) with cryptographic proof.
Server validates proof, sends CHALLENGE_ACK_ACK (msg_type=10), and sets *(BYTE*)(peer_state+70) = 1.

The exploit skips step 3 entirely. The attacker intercepts the CHALLENGE and immediately crafts a CHALLENGE_ACK_ACK with a non‑zero verify_status byte. Because vbond_proc_msg() exempts msg_type=10 from authentication checks, the packet reaches the vulnerable handler, which blindly trusts the client‑supplied status and marks the peer as authenticated.

The extension renders these two flows side‑by‑side, highlighting the missing validation gate, and overlays the exact binary patch (upgrade to v20.12.6.1) that introduces the state‑machine enforcement.

Detection & Mitigation Built In

Beyond visualisation, the Knowledge Engine codifies actionable detection guidance directly from the exploit research:

vsyslog anomaly: Alert on control-connection-state-change with peer-vmanage-system-ip of 0.0.0.0 followed by immediate down state.
auth.log anomaly: Unexpected SSH key acceptance for vmanage-admin on port 830 immediately after DTLS instability.
Network ACLs: Strictly restrict inbound DTLS ports (12346, 52521) to known edge routers.
Patch imperative: Upgrade to v20.12.6.1+, which adds the missing verify_status validation.

Every answer is synthesized from the local JSON store; the assistant is not a generative AI that hallucinates. It’s a deterministic retrieval engine that guarantees factual accuracy.

Passion in Every Component

This wasn’t a casual build. The extension reflects a deep obsession with protocol‑level security research. I manually disassembled the vdaemon logic, traced the memory writes, and translated the binary analysis into interactive UI elements. The NLP engine itself was hand‑crafted - no TensorFlow, no external models - because I wanted the intellectual satisfaction of building a pure, dependency‑free reasoning core that respects the air‑gap.

The project is a love letter to the art of defense: taking an attacker’s blueprint and forging a shield that educates and protects simultaneously. The World Cup of cybersecurity is happening every day in data centers and SOCs, and this tool is my seat in the stands, cheering for the blue team.

From Zero to Manifest V3: How GitHub Copilot Helped Me Finish an RSC Vulnerability Detector for CVE‑2025‑55182

Anuththara Wickramasekara — Sun, 31 May 2026 14:20:47 +0000

This is a submission for the GitHub Finish-Up-A-Thon Challenge

From Zero to Manifest V3: How GitHub Copilot Helped Me Finish an RSC Vulnerability Detector for CVE-2025-55182

What I Built

RSC Fingerprint Detector - a Manifest V3 Chrome extension that performs passive and active reconnaissance of React Server Components (RSC) and the React2Shell vulnerability class (CVE-2025-55182, CVE-2025-66478). These vulnerabilities stem from unsafe deserialisation of the React Flight protocol, enabling unauthenticated remote code execution on any Next.js App Router endpoint.

The extension implements a dual-phase detection pipeline:

Passive fingerprinting: Heuristic analysis of the global namespace (window.__next_f), script asset introspection (react-server-dom-webpack), DOM attribute scanning (data-rsc, data-reactroot), and response header inspection (Content-Type: text/x-component, Vary: RSC).
Active probing: A cross-origin fetch with a custom X-RSC-Probe header, followed by content-type entropy analysis and Flight protocol signature extraction.

The original project was a 50-line ephemeral script that relied on manual DevTools injection. The finished version is a fully isolated, event-driven Chrome extension with a declarative ruleset, persistent IndexedDB storage, and a reactive UI - all built with GitHub Copilot as the primary force multiplier.

Demo

Repository: https://github.com/anuththara2007-W/CVE-2025-55182-Exploit-extension

Visual proof of completion arc:

Before (abandoned console script)	After (production extension)
Only raw console output, no UI, single detection vector	Modern popup, status badges, active probe results, CVE mapping

Before screenshot: https://github.com/anuththara2007-W/CVE-2025-55182-Exploit-extension/raw/main/images/img1.png
After screenshot: https://i.postimg.cc/wT2vX4xH/Annotation-2026-05-31-184616.png

The Comeback Story

December 2025 - The CVE Disclosure

When CVE-2025-55182 was publicly disclosed (CVSS 10.0, unauthenticated RCE via Flight protocol deserialisation), I wrote a minimal Python script that checked for window.__next_f. It worked, but it was a single-vector, synchronous, non-persistent tool. Each scan required manual injection of the script into the target page's console. The script was abandoned after 48 hours because the effort to productionise it (manifest, permission handling, cross-context messaging, error recovery) exceeded the perceived value.

May 2026 - The Revival

The Finish-Up-A-Thon provided a forcing function. Using GitHub Copilot as a context-aware pair programmer, I transformed the script into a production extension with the following architectural improvements:

Component	Original (Dec 2025)	Finished (May 2026)	Technical Depth
Detection vectors	1 (`window.__next_f`)	4 (globals, script asset fingerprinting, DOM attributes, response headers)	Multi-heuristic fusion reduces false negatives
Active fingerprinting	None	`fetch` with `X-RSC-Probe`, content-type parsing, Flight protocol signature detection	AbortController timeout, CORS-aware, idempotent retry
Execution context	Console injection	Isolated content script + background service worker	Cross-context message passing with `chrome.runtime.sendMessage` and mandatory `return true` for async response
State persistence	None (ephemeral)	IndexedDB schema (object stores: `detections`, `flights`) with ACID transactions	Schema versioning, index creation (`timestamp`), FIFO eviction
UI/UX	Raw terminal	Web-based popup with reactive event handlers and status badges	CSS Grid/flex, card design, shadow DOM isolation
Distribution	Local script	Unpacked Chrome extension with `manifest.json` (MV3)	`declarativeNetRequest` permission, `host_permissions` for `<all_urls>`

The completion arc is not just feature addition - it is a migration from an ad-hoc, single-tenant script to a reusable, multi-tenant security utility that respects Chrome's extension security model (CSP, isolated worlds, least privilege).

My Experience with GitHub Copilot - Technical Breakdown

Without Copilot, this extension would still be a forgotten folder. Copilot acted as a semi-autonomous engineering partner, handling the following high-complexity tasks:

Technical Area	Specific Copilot Contribution	Why a Human (or I) Would Have Struggled
Manifest V3 permissions	Generated the entire `manifest.json` with `activeTab`, `scripting`, `declarativeNetRequest`, `host_permissions`, and the correct `service_worker` registration	MV3 deprecated background pages. Copilot knew the new schema and avoided the `persistent` flag error.
Cross-context message passing	Wrote `chrome.runtime.onMessage` listeners with the required `return true` to keep the message channel open for asynchronous `sendResponse`	I would have forgotten `return true`, causing silent failures in the popup.
IndexedDB schema design	Produced the `initDB` function with `onupgradeneeded` handler, object store creation, and index definitions (`timestamp`)	I had never written IndexedDB without a wrapper. Copilot generated transaction boundaries and error recovery.
Declarative DOM scanning	Suggested `document.querySelectorAll('[data-rsc], [data-reactroot], #__next')` and the fallback to `window.__next_f`	I did not know all RSC markers. Copilot extracted them from its training corpus of React codebases.
Active probe fetch with AbortController	Generated a `fetch` with a 2-second timeout, custom headers, and response header extraction, including CORS-aware error handling	Writing a timeout with `AbortController` and cleaning up the abort listener is error-prone. Copilot did it correctly.
Popup UI reactivity	Built the entire HTML/CSS card layout, plus the `addEventListener` wiring and state synchronisation with `chrome.storage.local`	I am not a frontend developer. Copilot produced a modern, accessible UI that works across Chrome versions.
Error recovery and idempotency	Added `try/catch` blocks to every async operation and implemented retry logic for transient IndexedDB lock errors	Without this, the extension would freeze on first error. Copilot made it resilient.

The single most impressive Copilot moment:

When I started typing // Capture RSC responses via webRequest, Copilot auto-completed the entire chrome.webRequest.onHeadersReceived listener, including the filtering condition (details.responseHeaders.some(h => h.name.toLowerCase() === 'content-type' && h.value.includes('text/x-component'))) and the asynchronous saveFlight call. It even added a comment explaining that MV3 requires 'responseHeaders' in the extraInfoSpec array. That single completion saved me 90 minutes of reading Chrome's migration guide.

Copilot did not write the whole extension. I architected the detection heuristics, chose the CVE-2025-55182 mapping, and performed manual testing on live targets (e.g., nextjs.org, vercel.com, local Next.js sandboxes). But Copilot handled the boilerplate, the edge cases, and the Chrome-specific quirks - turning a 50-line script into a 500-line production extension in two evenings.

Technical Deep Dive - How Copilot Solved Specific Problems

Asynchronous idempotency in message handlers

Copilot correctly added return true inside chrome.runtime.onMessage to indicate that the response will be sent asynchronously. Without this, the popup would time out.
IndexedDB versioning and schema migration

Copilot generated the onupgradeneeded block with conditional object store creation, preventing ConstraintError on subsequent extension updates.
Closure serialisation for injected scripts

When injecting the detection function via chrome.scripting.executeScript, Copilot used func instead of code, avoiding CSP violations and maintaining lexical scope.
DeclarativeNetRequest vs WebRequest

Copilot recommended using declarativeNetRequest for passive header inspection, which is more performant and aligns with MV3's shift away from blocking webRequest.
Heuristic entropy reduction

Copilot suggested combining multiple low-certainty signals (e.g., data-rsc + #__next + __next_f) into a confidence score, reducing false positives.

Without Copilot, this extension would not exist. With Copilot, it is a robust, field-ready security tool.

Team submission: Solo developer - Anuththara Wickramasekara

Disclaimer: This tool is intended for authorised security testing and educational purposes only. Use only on systems you own or have explicit permission to test. The author assumes no liability for misuse.