iveresk/CVE-2022-29885

GitHubRepository PoC

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2022-29885Dockerfile

1 Dockerfile

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Environment assessment

A single-container environment built from a Dockerfile that compiles and runs a Go-based Denial-of-Service exploit for CVE-2022-29885 against Apache Tomcat clusters.

Dockerfile:1-21README.md:1-49

Lab assessment

Vulnerability lab

The repository explicitly names CVE-2022-29885, provides a Dockerfile to build an exploit binary, and includes source code that sends crafted TCP payloads to trigger a denial-of-service condition in Apache Tomcat clusters. The README describes the vulnerability, usage, and a Docker command to run the exploit.

Dockerfile:1-21README.md:1-49cve-2022-29885.go:1-325
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

exploit-builder

builds the exploit binary

A multi-stage Docker build based on golang:1.17-alpine that copies Go source files, downloads modules, and compiles the binary /cve-2022-29885.

Dockerfile:1-21

exploit-runner

executes the DoS exploit

The default container command runs the compiled /cve-2022-29885 binary with a target file argument. The binary reads targets from a file or command line, iterates over a hardcoded list of common Tomcat ports, and sends either a safe or unsafe payload in a loop every 3 minutes.

Dockerfile:20run-cve.go:1-92

payload-generator

provides safe and unsafe exploit payloads

Defined in cve-2022-29885.go, it contains a hardcoded safePayload byte slice and an encrypted unsafe payload (variable 'payload') that is decrypted at runtime using AES-CBC with hardcoded key and IV. The doSafe and doUnsafe functions send these payloads to the target.

cve-2022-29885.go:1-325
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-29885

Supported by supplied evidence

The repository name, README, and source code all explicitly reference CVE-2022-29885. The code implements a TCP-based DoS attack against Apache Tomcat clusters, matching the described vulnerability in the clustering function's EncryptInterceptor.

README.md:1-4cve-2022-29885.go:1-325run-cve.go:1-92
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A target Apache Tomcat server with clustering enabled and NioReceiver configured, reachable from the container network.README.md:5-7
  • A target file (targets.txt) or command-line argument specifying the IP address(es) of the vulnerable Tomcat instances.Dockerfile:6-7run-cve.go:24-28
  • Network connectivity from the container to the target on ports 8080, 80, 443, 8443, 8081, 3389, 7443, 5443, 8888, 1723.run-cve.go:22

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile, which compiles the Go exploit.Dockerfile:1-21
  2. Run the container with a target file or override the INPUT_FILE build argument to specify the target IP(s).Dockerfile:6-7README.md:22-30
  3. The container continuously sends crafted TCP payloads to the target on common Tomcat ports every 3 minutes, causing a denial of service.run-cve.go:60-90
Safety-review evidence

Behaviors behind the stored safety assessment

Suspicious behavior

The README and code contain political rhetoric and explicitly encourage attacking 'ruzzian Apache Tomcat servers' and 'ruzzland-terrorist-state VoIP devices'. The container, when run, automatically and repeatedly sends DoS traffic to a user-supplied target without any built-in authorization check. While the exploit itself is a documented lab exercise, the combination of hardcoded targeting of a specific nation-state's infrastructure and the call to action in the README indicates a potential for real-world misuse beyond a controlled lab environment.

README.md:32-38run-cve.go:60-90

Indicators requiring review

  • The README explicitly encourages attacking 'ruzzian Apache Tomcat servers' and 'ruzzland-terrorist-state VoIP devices', framing the exploit as a tool for real-world offensive operations rather than a purely educational lab.README.md:32-38
  • The main loop in run-cve.go continuously attacks the target every 3 minutes indefinitely, with no built-in mechanism to limit the attack to a controlled test environment.run-cve.go:60-90
Review boundaries

What the analysis did not establish

  • The file rus-ship-go-fuck-yourself.jpeg is an uninspected binary (image) and its content is not analyzed.
  • The Dockerfile uses ADD . ./ which copies all files from the build context, including the uninspected JPEG, but no executable behavior from that file is observed.
  • The packet does not include a docker-compose.yml or any runtime configuration that would confirm the exact network setup or target isolation.
  • The safety assessment relies on the stated intent in the README; actual runtime behavior against a real target cannot be verified from static analysis alone.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

1