j3r1ch0123 Exploits and Proofs of Concept

Showing 5 PoCs on this page

GitHub

j3r1ch0123/CVE-2025-9074

Repository PoC8Created 2025-09-03ExploitCVE-2025-90742 files

3.7 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

A Python script that interacts with the Docker Remote API over HTTP to create, start, and optionally clean up a container, demonstrating exploitation of an unauthenticated Docker daemon.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python PoC for CVE-2025-9074 that interacts with the Docker Engine API to create, start, log, and optionally clean up a container. The code performs only the documented exploit behavior: it sends HTTP requests to the Docker API to run a user-supplied command inside a new Alpine container. No backdoor, concealed payload, persistence, credential theft, or unrelated remote access is present. The README and script include standard disclaimers and educational framing.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareDocker DesktopDocker Engine

Attack typesPrivilege EscalationContainer Escape

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script is named 'exploit.py', defines a function called 'exploit', and programmatically creates, starts, and controls a Docker container via the unauthenticated API, which constitutes active exploitation of the vulnerability.

exploit.py:7exploit.py:15-25exploit.py:41-42

Requirements

A Docker daemon listening on TCP without authentication (e.g., tcp://0.0.0.0:2375).README.md:32
Network access to the Docker API endpoint.exploit.py:25

Observed behavior

Sends a POST request to /containers/create with a JSON payload specifying the 'alpine' image, a user-supplied command, and a host bind mount.exploit.py:15-25
Sends a POST request to /containers/{id}/start to start the created container.exploit.py:41-42
Fetches and prints container logs via GET /containers/{id}/logs.exploit.py:51-55
Optionally stops and removes the container via POST /containers/{id}/stop and DELETE /containers/{id}.exploit.py:60-66

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Payload withheldThis is the normal exploit behavior for CVE-2025-9074 and matches the documented purpose of the PoC.exploit.py:7-66
Hardcoded Host Mount: Payload withheldThis mount path is hardcoded in the container creation payload and is part of the demonstrated attack scenario (mounting host drive). It is not concealed and is consistent with the CVE description.exploit.py:19-21

Review boundaries

What the analysis did not establish

The evidence includes only the README.md and exploit.py files; no other repository files (e.g., Dockerfiles, configuration) were provided.
The code was not executed, so its operational reliability and safety are not verified.
Only the two text files (README.md and exploit.py) were reviewed; no binary files were present or analyzed.
The review does not assess whether the PoC actually works or is safe to run; it only evaluates the presence of backdoor or deceptive behavior in the supplied evidence.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub