UNICORDev/exploit-CVE-2021-22204

GitHubRepository PoC

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2021-22204Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker environment based on Ubuntu that installs ExifTool 12.23 and the exploit script for CVE-2021-22204, providing a contained lab for generating and testing malicious JPEG images.

Dockerfile:1-21README.md:1-81

Lab assessment

Vulnerability lab

The repository name, README, Dockerfile, and exploit script all explicitly reference CVE-2021-22204 and describe a purpose of demonstrating and exploiting the vulnerability. The Dockerfile installs a vulnerable version of ExifTool and copies the exploit script, creating a self-contained environment for vulnerability research.

README.md:1-3Dockerfile:1-21exploit-CVE-2021-22204.py:1-10
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

environment definitionvulnerable target installationexploit tool provisioning

Defines a container based on Ubuntu, installs ExifTool 12.23 (vulnerable to CVE-2021-22204) and dependencies, copies the exploit script and other files, and sets the working directory and entrypoint to bash.

Dockerfile:1-21

exploit-CVE-2021-22204.py

exploit generatorpayload creator

A Python script that generates a malicious JPEG image exploiting CVE-2021-22204. It creates a DjVu file with an embedded Perl payload, injects it into a JPEG using ExifTool, and supports custom commands or reverse shells.

exploit-CVE-2021-22204.py:1-198

README.md

documentationusage guide

Provides an overview of the exploit, vulnerability description, usage instructions, requirements, and credits. It describes how to set up a vulnerable environment and test the generated payload.

README.md:1-81

.gitignore

build artifact exclusion

Lists files to be ignored by Git, including generated payload and temporary files from the exploit process.

.gitignore:1-7

.github/FUNDING.yml

funding configuration

A GitHub funding configuration file for the repository, unrelated to the vulnerability lab functionality.

.github/FUNDING.yml:1-15
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-22204

Supported by supplied evidence

The exploit script explicitly states it targets CVE-2021-22204, the Dockerfile installs the vulnerable ExifTool version 12.23, and the README describes the vulnerability and exploit. All components align with the CVE description.

exploit-CVE-2021-22204.py:1-10Dockerfile:7-8README.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.Dockerfile:1
  • The exploit script requires Python 3 and the dependencies djvulibre-bin and exiftool, which are installed in the Dockerfile.exploit-CVE-2021-22204.py:1Dockerfile:7

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-21
  2. Run a container from the image, which starts a bash shell.Dockerfile:21
  3. Inside the container, execute the exploit script with desired options (e.g., -c for command or -s for reverse shell) to generate a malicious JPEG.exploit-CVE-2021-22204.py:1-198README.md:27-33
  4. Test the generated payload by running 'exiftool image.jpg' to trigger the exploit.README.md:75-77
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and exploit script are designed to operate within the container. The exploit generates a payload that executes arbitrary commands, but this is the intended behavior for a vulnerability lab. There is no evidence of hidden, unnecessary, or externally directed compromise. The container does not expose ports, mount host filesystems, or run in privileged mode. The reverse shell option connects to a user-specified IP, which is a standard feature of such exploits and not an automatic external connection.

Dockerfile:1-21exploit-CVE-2021-22204.py:1-198
Review boundaries

What the analysis did not establish

  • The packet does not include a docker-compose.yml or any runtime configuration, so port mappings, volume mounts, or privileged mode cannot be assessed.
  • The exploit script's reverse shell functionality could be used to connect to an external host, but this is a documented feature and not automatically triggered.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1