UNICORDev/exploit-CVE-2022-25765

GitHubRepository PoC

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2022-25765Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized environment that builds an Ubuntu container, installs Python 3, Ruby, and the vulnerable pdfkit gem version 0.8.6, copies the exploit script and requirements, and sets the exploit as the entrypoint.

Dockerfile:1-16

Lab assessment

Vulnerability lab

The Dockerfile installs a specific vulnerable version of pdfkit (0.8.6) and the entrypoint is an exploit script for CVE-2022-25765. The README explicitly describes it as an exploit for CVE-2022-25765 and provides usage instructions for security research.

Dockerfile:7-8Dockerfile:15README.md:1-3exploit-CVE-2022-25765.py:2-9
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the lab environment

Defines an Ubuntu-based image, installs Python 3, Ruby, and pdfkit 0.8.6, copies the local source code, installs Python dependencies, and sets the exploit script as the entrypoint.

Dockerfile:1-16

exploit-CVE-2022-25765.py

exploit script for CVE-2022-25765

A Python script that generates command injection payloads for vulnerable pdfkit versions. It supports custom command mode, reverse shell mode, and sending payloads to a target website via POST. It prints payloads and usage instructions; it does not execute the payloads locally.

exploit-CVE-2022-25765.py:1-192

requirements.txt

Python dependency manifest

Lists required Python packages: requests and urllib3.

requirements.txt:1-6

README.md

documentation

Provides an overview of the exploit, usage instructions, requirements, and credits. States the environment is for educational and authorized security research purposes only.

README.md:1-89

.gitignore

ignores Ruby and HTML files

Specifies that *.rb and *.html files should be ignored by Git.

.gitignore:1-2
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-25765

Supported by supplied evidence

The Dockerfile installs pdfkit version 0.8.6, which is within the vulnerable range (< 0.8.7.2) described in the exploit script and README. The exploit script is explicitly labeled for CVE-2022-25765 and generates payloads targeting the command injection vulnerability.

Dockerfile:7-8exploit-CVE-2022-25765.py:2-9README.md:7-9
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.Dockerfile:1
  • The container must be built from the Dockerfile.Dockerfile:1-16
  • The exploit script requires Python 3 and the requests/urllib3 packages (installed during build).requirements.txt:1-6Dockerfile:12
  • To exercise the vulnerability, a target running a vulnerable pdfkit version (e.g., a web application) must be accessible, or the payload must be manually used in a Ruby context.README.md:11-13exploit-CVE-2022-25765.py:50-55

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-16
  2. Run the container, which executes the exploit script as the entrypoint.Dockerfile:15
  3. Provide command-line arguments to the exploit script (e.g., -c for custom command, -s for reverse shell, optionally -w and -p for a target website).exploit-CVE-2022-25765.py:50-55
  4. The script generates a payload URL. If a target website is specified, it sends the payload via POST; otherwise, it prints the payload for manual use.exploit-CVE-2022-25765.py:80-120
  5. The payload, when processed by a vulnerable pdfkit instance, triggers command injection on the target system.README.md:11-13
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script only generates and optionally sends payloads to a user-specified target; it does not execute commands locally, establish reverse shells to the host, or perform any destructive actions. The Dockerfile does not contain any hidden or unnecessary behavior. The environment is self-contained and intended for authorized security research.

exploit-CVE-2022-25765.py:80-120Dockerfile:1-16README.md:5
Review boundaries

What the analysis did not establish

  • No Docker Compose file or network configuration is provided; the lab is a standalone Dockerfile.
  • The exploit script's behavior when sending payloads to a target website depends on external systems not included in the packet.
  • The packet does not include a vulnerable target application; the user must supply one.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1