db
database
MySQL 5.7.44 database service that stores WordPress data. It is configured with a database named 'wordpress' and credentials for the WordPress user.
docker-compose.yml:4-11flame-11/CVE-2017-20192-formidable-forms
PoC files
5 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Bash script that validates the presence of CVE-2017-20192 (stored XSS) by submitting a crafted payload to a Formidable Forms instance and then checking an admin view for the injected script marker. It does not deliver the payload to a victim's browser.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a README and a bash script that automates reproduction of CVE-2017-20192 (stored XSS). The script submits a crafted form entry, logs in as admin, and checks for the XSS payload in the admin view. No backdoor, deceptive payload, or concealed operator-directed harm is present.
ClassificationScanner
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The script's primary operation is to detect and report the presence of the vulnerability by checking for a stored marker in an admin view. It does not deliver the payload to a victim browser or perform any action beyond validation. The README explicitly describes it as a 'helper script' that 'checks for the stored marker'.
README.md:16-19scripts/poc.sh:83-88Requirements
- A running instance of the vulnerable Formidable Forms plugin (< 2.05.03) with a form identified by the key 'cve-2017-20192'.
README.md:3scripts/poc.sh:7 - Network access to the target WordPress instance.
scripts/poc.sh:4
Observed behavior
- Fetches the form preview HTML to extract form_id, form_key, and field_id.
scripts/poc.sh:36-43 - Submits an unauthenticated POST request containing a crafted XSS payload to the form entry endpoint.
scripts/poc.sh:54-58 - Logs in as a WordPress administrator and fetches the admin entry view for the submitted form.
scripts/poc.sh:60-81 - Checks the admin entry view HTML for the presence of the injected script marker and reports 'VULNERABLE' or 'NOT VULNERABLE'.
scripts/poc.sh:83-88
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Submits a crafted XSS payload to a local WordPress instance and validates the vulnerability by checking for a unique token in the admin entry view.The script's actions are entirely consistent with a legitimate PoC for the stated CVE. It does not exfiltrate data, establish persistence, or perform any unrelated actions.
scripts/poc.sh:20-30scripts/poc.sh:55-58scripts/poc.sh:83-84
What the analysis did not establish
- Evidence coverage is incomplete: 3 of 5 files in the repository were omitted from the packet, and complete_artifact_coverage is false.
- The analysis is based solely on static review of the provided source code; the script was not executed, and its behavior in a live environment is not confirmed.
- Three files (total 5) were omitted from the text evidence; their metadata indicates they are not analyzed, but their content is unavailable for review.
- Binary files were flagged as metadata-only and not analyzed, though none were reported in this packet.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Vuln labCVE-2017-20192Compose · images
Analysis
Environment assessment
A Docker Compose environment that deploys a MySQL database, a WordPress 5.2.3 instance with Apache, and a one-shot CLI container that installs the Formidable Forms plugin (version 2.05.02) and configures a test form. The environment is designed to reproduce CVE-2017-20192, a stored XSS vulnerability in Formidable Forms.
docker-compose.yml:1-51README.md:1-3Lab assessment
Vulnerability labThe README explicitly states the repository is a 'Reproducible Docker lab for CVE-2017-20192'. The Compose file deploys a specific vulnerable version of Formidable Forms (2.05.02) and includes a proof-of-concept script (poc.sh) that demonstrates the stored XSS.
README.md:1-3docker-compose.yml:37scripts/poc.sh:1-90Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
wordpress
web applicationvulnerable target
WordPress 5.2.3 with Apache, exposing port 18080 on the host. It depends on the db service and uses the wp_data volume for persistent files. The Formidable Forms plugin (version 2.05.02) is installed by the wp-init service, making this the target for the stored XSS vulnerability.
docker-compose.yml:13-25scripts/wp-init.sh:47-57wp-init
initializationplugin installerform creator
A one-shot WordPress CLI container that runs as root (user 0:0). It waits for the database and WordPress, installs WordPress if needed, downloads and activates Formidable Forms 2.05.02 from the official WordPress plugin repository, creates a test form with key 'cve-2017-20192', and publishes a page embedding the form. It also fixes ownership of wp-content for the www-data user.
docker-compose.yml:27-46scripts/wp-init.sh:1-153poc.sh
proof-of-concept exploit
A bash script that demonstrates the stored XSS vulnerability. It submits a crafted entry containing an SVG payload to the Formidable form without authentication, logs in as the WordPress admin, and checks the admin entry view for the executed payload marker.
scripts/poc.sh:1-90How the supplied evidence relates each vulnerability
CVE-2017-20192
Supported by supplied evidence
The environment explicitly targets CVE-2017-20192 by deploying Formidable Forms 2.05.02, which is below the fixed version 2.05.03. The poc.sh script demonstrates a stored XSS attack by injecting an SVG payload into a form entry and verifying its execution in the admin view, consistent with the CVE description.
README.md:1-3docker-compose.yml:37scripts/poc.sh:1-90Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose must be installed to run the environment.
README.md:7-9 - The lab expects the WordPress admin credentials (admin/admin) and the target URL (http://127.0.0.1:18080) as configured in the Compose file.
docker-compose.yml:33-36
Evidence-described exercise path
- Start the lab environment with 'docker compose up -d --build'.
README.md:7-9 - Run the proof-of-concept script 'bash ./scripts/poc.sh' to submit a crafted entry and verify the stored XSS.
README.md:17-19 - The poc.sh script submits an unauthenticated entry with an SVG payload, logs in as admin, and checks the admin entry view for the marker.
scripts/poc.sh:1-90
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the lab's own target (the WordPress/Formidable instance). The poc.sh script only interacts with the local lab services on 127.0.0.1:18080, and the wp-init.sh script downloads the Formidable plugin from the official WordPress repository and configures the lab. There is no evidence of host escape, external connections beyond the lab, persistence outside the lab, credential theft, or destructive actions.
scripts/poc.sh:1-90scripts/wp-init.sh:1-153docker-compose.yml:1-51What the analysis did not establish
- The .gitignore file is not included in the evidence, but its absence does not affect the analysis.
- The packet does not include the actual Formidable plugin zip file; it is downloaded at runtime from the official WordPress repository, which is a standard lab initialization step.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.