KrE80r/cve-2021-3007-vulnerable

GitHubRepository PoCScanner

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a deliberately vulnerable test environment designed to validate detection of CVE-2021-3007 by security scanners. It includes a Dockerfile, a README with instructions for testing with nuclei, and a PHP application that deserializes user input. The primary stated purpose is scanner validation, not exploitation.

Backdoor review

No backdoor observed in reviewed code

The repository is a deliberately vulnerable test environment for CVE-2021-3007. All supplied files (Dockerfile, README.md, index.php) openly document and implement the intended insecure deserialization vulnerability. No concealed backdoor, unrelated payload, or deceptive behavior was observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPHPDockerfile
Target softwareLaminas HTTPZend Framework
Attack typesinsecure deserialization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary stated purpose is to serve as a test environment for validating security scanner detection of CVE-2021-3007. The README explicitly describes it as a 'vulnerable test environment for validating CVE-2021-3007 detection in security scanners' and 'Created for nuclei template validation'. While it contains a vulnerable application that could be exploited, the artifact itself is designed to be detected by scanners, not to actively exploit a target. The included manual exploitation test is for verifying the environment's vulnerability, not for attacking external systems.

README.md:7README.md:130

Requirements

  • Docker and docker-compose must be installed to run the environment.README.md:3
  • The nuclei scanner is optionally required for validation.README.md:33

Observed behavior

  • The PHP application accepts base64-encoded serialized data via POST or GET parameters and deserializes it using unserialize().index.php:19-39
  • The README provides a manual exploitation test command that sends a serialized payload to trigger RCE and expects a specific response.README.md:49-52
  • The README states the environment is for validating CVE-2021-3007 detection in security scanners and for nuclei template validation.README.md:7README.md:130
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Code
unserialize(base64_decode($input))The index.php file intentionally deserializes untrusted user input, which is the documented CVE-2021-3007 vulnerability.index.php:36-39
Documented Vulnerability
CVE-2021-3007The README and Dockerfile explicitly state the environment is intentionally vulnerable to CVE-2021-3007 for security testing.README.md:7Dockerfile:3-5
Review boundaries

What the analysis did not establish

  • Three of six total files were omitted from the text evidence (docker-compose.yml, LICENSE, and one other). Their content is not available for analysis.
  • The evidence does not include the nuclei template (CVE-2021-3007.yaml) referenced in the README.
  • The analysis is based solely on static review of the provided text; no code was executed.
  • Three additional files (docker-compose.yml, LICENSE, and a nuclei template) were present in the repository metadata but their content was not included in the evidence packet. Based on the file names and the repository's stated purpose, they are unlikely to contain backdoor behavior, but their absence is a limitation.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2021-3007Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a single PHP 8.1 Apache container intentionally vulnerable to CVE-2021-3007 (Laminas/Zend Framework insecure deserialization). The container installs specific vulnerable library versions and serves a PHP script that base64-decodes and unserializes user-supplied input.

docker-compose.yml:1-18Dockerfile:1-52index.php:1-47README.md:1-130

Lab assessment

Vulnerability lab

The README explicitly states it is an 'Intentionally vulnerable test environment for validating CVE-2021-3007 detection in security scanners.' The Dockerfile installs specific vulnerable package versions and the PHP application contains a deliberate unserialize() call on user input. The compose file maps port 8080 for testing.

README.md:1-5Dockerfile:3-5index.php:3-6
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

vulnerable web applicationCVE-2021-3007 target

A PHP 8.1 Apache container built from the local Dockerfile. It installs vulnerable versions of laminas/laminas-http (2.14.1), laminas/laminas-view (2.12.0), laminas/laminas-config (3.7.0), and laminas/laminas-zendframework-bridge (1.8.0) via Composer. It serves index.php, which accepts GET/POST parameters 'data', 'payload', or 'serialized', base64-decodes them, and calls unserialize(). The container exposes port 80 internally, mapped to host port 8080.

docker-compose.yml:7-10Dockerfile:1-52index.php:1-47
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-3007

Supported by supplied evidence

The environment is explicitly built to demonstrate CVE-2021-3007. The Dockerfile installs laminas/laminas-http 2.14.1, which is vulnerable according to the README (affected: Laminas HTTP < 2.14.2). The index.php script contains the vulnerable unserialize() call, and the README provides a gadget chain and a proof-of-concept payload.

Dockerfile:3-5Dockerfile:30-34index.php:36-40README.md:9-14
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed on the host.README.md:17-19
  • The host must have network access to pull the base image php:8.1-apache and the Composer image, and to download Composer packages.Dockerfile:1Dockerfile:20

Evidence-described exercise path

  1. Clone the repository and navigate into the directory.README.md:19-20
  2. Start the vulnerable environment with 'docker-compose up -d'.README.md:22-23
  3. Verify the container is running by accessing http://localhost:8080.README.md:25-26
  4. Send a crafted serialized payload (base64-encoded) to the application via POST to http://localhost:8080/ with parameter 'data', 'payload', or 'serialized' to trigger deserialization and achieve RCE.README.md:37-42index.php:18-40
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own container and is necessary for the vulnerability exercise. The container runs a vulnerable PHP application that deserializes user input, which is the intended target. There is no evidence of host escape, external connections beyond package installation, persistence mechanisms, credential theft, or destructive actions. The port mapping (8080:80) is a standard lab requirement for local testing.

docker-compose.yml:1-18Dockerfile:1-52index.php:1-47README.md:1-130
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1