aeyesec/CVE-2024-27316_poc

GitHubRepository PoC

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2024-27316Compose · builds

1 Compose manifest · 2 Dockerfiles · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs two Apache httpd containers (v2.4.58 and v2.4.59) with HTTP/2 enabled, alongside a Node.js PoC script that sends a flood of HTTP/2 CONTINUATION frames to demonstrate CVE-2024-27316.

docker-compose.yml:1-17README.md:1-39

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2024-27316, and the environment provides a vulnerable (2.4.58) and a fixed (2.4.59) Apache httpd server with HTTP/2 enabled, along with a script that sends a CONTINUATION flood to trigger the vulnerability.

README.md:1README.md:3README.md:7README.md:13
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

cve-2024-27316_v2458

vulnerable target server

Apache httpd 2.4.58 container with HTTP/2 enabled, exposed on host ports 3392 (HTTP) and 3393 (HTTPS). It is the vulnerable version for the PoC.

docker-compose.yml:4-9httpd-2_4_58/Dockerfile:1-25README.md:7

cve-2024-27316_v2459

fixed target server

Apache httpd 2.4.59 container with HTTP/2 enabled, exposed on host ports 3394 (HTTP) and 3395 (HTTPS). It is the patched version for comparison.

docker-compose.yml:10-16httpd-2_4_59/Dockerfile:1-25README.md:13

poc.js

exploit script

A Node.js script that connects to the target server, performs an HTTP/2 handshake, and sends a large number of CONTINUATION frames with oversized header names to trigger a CONTINUATION flood. It targets the vulnerable server by default.

poc.js:1-181README.md:33-36
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-27316

Supported by supplied evidence

The environment is explicitly labeled as a PoC for CVE-2024-27316, provides a vulnerable Apache httpd 2.4.58 and a fixed 2.4.59, and the PoC script implements a CONTINUATION flood attack consistent with the CVE description.

README.md:1README.md:7README.md:13poc.js:1-181
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the target servers.README.md:5-6
  • Node.js and npm must be installed to run the PoC script.README.md:33-36
  • The npm dependencies (hpack.js) must be installed via 'npm ci'.README.md:34package.json:11-13

Evidence-described exercise path

  1. Start the target servers using 'docker-compose up -d'.README.md:5-6
  2. Verify connectivity to the vulnerable server (v2.4.58) using curl with HTTP/2.README.md:9-10
  3. Verify connectivity to the fixed server (v2.4.59) using curl with HTTP/2.README.md:15-16
  4. Check resource status of the containers with 'docker stats'.README.md:20-21
  5. Install Node.js dependencies with 'npm ci'.README.md:34
  6. Run the PoC script with 'node poc.js' to send a CONTINUATION flood to the vulnerable server.README.md:35poc.js:1-181
  7. Stop the servers with 'docker-compose down'.README.md:25-26
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The PoC script only connects to localhost on the mapped ports of the lab containers and sends HTTP/2 frames. It does not attempt to escape the container, access the host filesystem, exfiltrate data, or establish persistence. The Docker Compose file does not use privileged mode or mount sensitive host directories. All behavior is directed at the intended lab targets.

poc.js:14-17poc.js:68-72docker-compose.yml:1-17
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1