A single-container environment built from python:3.9-slim that runs a FastAPI application (poc.py) on port 9600. The application includes endpoints for file upload, extension installation, and file retrieval, and is accompanied by a Nuclei template (cve-2024-4320.yaml) that describes a path traversal vulnerability leading to remote code execution.
The packet includes a proof-of-concept application (poc.py) with a vulnerable endpoint (/install_extension) that concatenates user input into a file path and loads a Python module, and a Nuclei template (cve-2024-4320.yaml) that describes and tests a path traversal vulnerability in that endpoint. The repository name and template description explicitly reference CVE-2024-4320. This is consistent with a vulnerability reproduction or demonstration environment.
vulnerable target applicationproof-of-concept server
A FastAPI server exposing endpoints /mount_extension, /install_extension, /uploadfile/, and /uploads/{filename}. The /install_extension endpoint constructs a file path by concatenating a base directory with user-supplied data.name, then uses importlib.machinery.SourceFileLoader to load and execute a Python module from that path. The /uploadfile/ endpoint saves uploaded files to /path/to/uploads. The /uploads/{filename} endpoint serves uploaded files. The application is the target of the described path traversal vulnerability.
A Nuclei template that sends a multipart file upload to /uploadfile/ containing a Python file, then sends a JSON POST to /install_extension with a path traversal payload in the name field pointing to the uploaded file, and finally requests the uploaded file via GET /uploads/. It expects a 200 status and the random string from the uploaded file content, demonstrating remote code execution via path traversal.
cve-2024-4320.yaml:1-51
Dockerfile
containerization definition
Defines a container based on python:3.9-slim, copies the current directory into /app, installs Python dependencies from requirements.txt, exposes port 9600, and runs the FastAPI application with uvicorn.
Dockerfile:1-18
requirements.txt
dependency manifest
Lists Python packages fastapi, uvicorn, pydantic, and python-multipart required by the application.
requirements.txt:1-4
CVE assessment
How the supplied evidence relates each vulnerability
The Nuclei template explicitly describes CVE-2024-4320 as a path traversal vulnerability in the /install_extension endpoint that allows arbitrary Python file execution. The poc.py code implements exactly that endpoint with direct concatenation of user input into a file path and dynamic module loading via SourceFileLoader, matching the described vulnerability.
cve-2024-4320.yaml:6-12poc.py:85-108
Exercise context
Requirements and sequence described by the evidence
Prerequisites
The container must be built and run, exposing port 9600.Dockerfile:1-18
The /path/to/uploads directory must be writable by the application to receive uploaded files.poc.py:111-121
The attacker must be able to reach the HTTP endpoints /uploadfile/, /install_extension, and /uploads/.poc.py:111-121poc.py:85-108poc.py:123-130
Evidence-described exercise path
Upload a malicious Python file (e.g., containing print("{{randstr}}")) to /uploadfile/.cve-2024-4320.yaml:16-24
Send a POST request to /install_extension with a JSON body containing a path traversal payload in the 'name' field that points to the uploaded file (e.g., ../../../../../../../../../../../path/to/uploads/{{randstr}}.py).cve-2024-4320.yaml:26-32
Verify execution by requesting the uploaded file via GET /uploads/{{randstr}}.py and checking for the expected output (the random string) in the response.cve-2024-4320.yaml:34-36cve-2024-4320.yaml:38-48
Safety-review evidence
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is confined to the containerized application. The Dockerfile does not use privileged mode, mount the Docker socket, or map host directories. The application listens on 0.0.0.0:9600, which is typical for a lab service. The exploit path targets the application's own file upload and extension loading logic to achieve code execution within the container, which is the expected demonstration of the vulnerability. No hidden persistence, credential theft, host escape, or external connectivity is observed.
No docker-compose file is present; port mapping and volume mounts are not defined, so the actual runtime exposure and filesystem isolation depend on how the container is launched.
The application uses hardcoded paths (/path/to/extensions_zoo_path, /path/to/uploads) that may not exist or be writable without additional volume configuration.
The Nuclei template is a static YAML file; its execution behavior depends on the Nuclei engine and is not inspected here.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.