nickylimjj/cve-2019-12735

GitHubRepository PoC

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2019-12735Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds an Ubuntu 20.04 container with a vulnerable version of Vim (8.1.1364) and a proof-of-concept exploit file. The README states it is a study environment for CVE-2019-12735.

Dockerfile:1-15README.md:1-2

Lab assessment

Vulnerability lab

The README explicitly states the repository is for studying the exploitation of CVE-2019-12735. The Dockerfile installs a vulnerable Vim version (8.1.1364) and creates a proof-of-concept file that triggers the vulnerability.

README.md:1-2Dockerfile:5-6Dockerfile:12-14
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the lab environment

Defines an Ubuntu 20.04 image, installs build tools, downloads and compiles Vim 8.1.1364, creates a non-root user, and writes a proof-of-concept exploit file.

Dockerfile:1-15

README.md

documents the lab purpose and usage

Describes the lab as a Docker image for studying CVE-2019-12735 exploitation, lists affected software, provides build/run/attach instructions, and credits inspiration.

README.md:1-26
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-12735

Supported by supplied evidence

The README explicitly associates the lab with CVE-2019-12735. The Dockerfile installs Vim 8.1.1364, which is within the affected range (<8.1.1365) stated in the README, and creates a proof-of-concept file that triggers the modeline vulnerability.

README.md:1-2README.md:5-6Dockerfile:5-6Dockerfile:12-14
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed on the host to build and run the container.README.md:9-12
  • The host must have 'make' available to execute the Makefile targets (build, run, attach).README.md:10-12

Evidence-described exercise path

  1. Build the Docker image using 'make build'.README.md:10
  2. Run the container with 'make run'.README.md:11
  3. Attach to the running container using 'make attach'.README.md:12
  4. Inside the container, open the proof-of-concept file with 'vim exploit/poc.txt' to trigger the vulnerability.README.md:15
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and README describe a self-contained vulnerability lab. The proof-of-concept command executes 'echo hacked; id; uname -a' inside the container, which is expected exploit demonstration behavior. No evidence of host escape, external connectivity, persistence, credential theft, or destructive actions beyond the lab target.

Dockerfile:12-14README.md:1-26
Review boundaries

What the analysis did not establish

  • The Makefile is not included in evidence_files, so exact run/attach commands (e.g., port mappings, volume mounts, privileged mode) are unknown.
  • The proof-of-concept command is hardcoded in the Dockerfile and does not show dynamic external payload retrieval, but its full effect depends on Vim's runtime behavior which is not inspected here.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1