CVE-2020-13756 Exploit Metadata

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

The artifact sets up a vulnerable Docker environment for CVE-2020-13756 and provides a curl command to verify the vulnerability by checking for a specific output string, which is scanner behavior.

Backdoor review

No backdoor observed in reviewed code

The repository provides a deliberately vulnerable Docker environment for CVE-2020-13756. The index.php file directly passes a user-supplied GET parameter to the known-vulnerable getSelectorsBySpecificity() function, which is the documented CVE behavior. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm is present in the reviewed text files.

ClassificationScanner

Model confidence95%

AuthenticationNot required

LanguagesPHPDockerfile

Target softwareSabberworm PHP CSS Parser

Attack typescode injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a vulnerable test environment and verification instructions. The index.php script is a deliberately vulnerable test harness, not an exploit. The README provides a curl command that tests for the vulnerability by checking for a specific output string ('VULN_TEST'), which is scanner behavior (detection/validation) rather than exploitation. No standalone exploit code is present.

README.md:1-3README.md:39-46index.php:1-20

Requirements

Docker must be installed and running to build and run the container.README.md:18
The target application must be accessible via HTTP on the specified port.README.md:43

Observed behavior

Builds a Docker image with a vulnerable version of Sabberworm PHP CSS Parser (8.3.0) and a test script that passes user input to the vulnerable getSelectorsBySpecificity function.Dockerfile:12-13index.php:14
Provides a curl command that sends a payload to the test script and checks if the response contains 'VULN_TEST', indicating successful code execution.README.md:42-44
Includes a Nuclei template reference for automated vulnerability scanning.README.md:50-52

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Code: index.php line 14: $selectors = $doc->getSelectorsBySpecificity('> ' . $_GET['n']);This is the exact vulnerable pattern described in CVE-2020-13756, where unsanitized user input reaches eval(). It is the intended PoC behavior, not a backdoor.index.php:14
Vulnerable Dependency: composer.json requires sabberworm/php-css-parser 8.3.0The Dockerfile installs the vulnerable version of the library, consistent with the stated CVE scope.Dockerfile:12-13

Review boundaries

What the analysis did not establish

One file (docker-compose.yml) is omitted from the text evidence; its content is unknown.
The Nuclei template file (CVE-2020-13756.yaml) is referenced but not included in the evidence.
One file (docker-compose.yml, 79 bytes) was not included as text content; only its metadata was provided. Its omission is noted but does not indicate backdoor behavior given the complete coverage of the core application files.
Binary files were not inspected; the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, and no binary files were identified in the artifact.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yml

Created 2025-12-06Vuln labCVE-2020-13756Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker Compose environment that builds and runs a PHP 8.0 Apache container serving a vulnerable Sabberworm PHP CSS Parser application, intended for demonstrating CVE-2020-13756 remote code execution.

docker-compose.yml:1-6Dockerfile:1-21index.php:1-20README.md:1-77

Lab assessment

Vulnerability lab

The README explicitly states it is a 'Vulnerable test environment for CVE-2020-13756', the Dockerfile installs a vulnerable version of the library, and index.php contains a deliberate vulnerable code path that passes user input to eval().

README.md:1-3Dockerfile:11-12index.php:8-13

Lab shapeCompose · builds

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable

web servervulnerable application

A service built from the local Dockerfile, exposing port 80 on the container mapped to host port 8080. It runs Apache with PHP 8.0 and serves index.php, which uses the Sabberworm PHP CSS Parser library version 8.3.0 and contains a deliberate eval() vulnerability.

docker-compose.yml:3-6Dockerfile:1-21index.php:1-20

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-13756

Supported by supplied evidence

The README describes the vulnerability as remote code execution in Sabberworm PHP CSS Parser < 8.3.1 via eval() in getSelectorsBySpecificity(). The Dockerfile installs version 8.3.0, and index.php demonstrates passing unsanitized user input to that function, matching the CVE description.

README.md:1-3README.md:7-13Dockerfile:11-12index.php:8-13

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed on the host to build and run the environment.README.md:17-19
Network access to port 8080 on the host to trigger the vulnerability via HTTP request.docker-compose.yml:5README.md:37-38

Evidence-described exercise path

Build and start the vulnerable container using docker-compose up -d or the provided one-liner.README.md:17-19
Send an HTTP request to the container with a crafted 'n' parameter that injects PHP code into the eval() call, e.g., curl 'http://localhost:8080/?n=100;printf(%22VULN_TEST%22);'.README.md:37-38index.php:8-13
Observe the response containing the output of the injected code (e.g., 'VULN_TEST'), confirming remote code execution.README.md:40

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own container: the Dockerfile installs a known vulnerable library and serves a deliberate exploit demonstration. The port mapping (8080:80) is a standard lab requirement for accessing the web service. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability exercise.

docker-compose.yml:1-6Dockerfile:1-21index.php:1-20README.md:1-77

Review boundaries

What the analysis did not establish

The packet does not include the composer.lock or vendor directory, so the exact installed library files are not inspected; the version is inferred from the composer.json requirement.
The Dockerfile uses a COPY --from=composer:latest instruction, which pulls an external image at build time; the behavior of that image is not inspected, but it is a standard Composer image.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2020-13756