PoC files

14 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created
Vuln labCVE-2020-1948Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a Dubbo Spring Boot provider sample, exposed on port 12345, intended for testing CVE-2020-1948.

docker-compose.yml:1-9Dockerfile:1-19README.md:1-73

Lab assessment

Vulnerability lab

The README explicitly states the environment is for testing CVE-2020-1948, and the Docker image is tagged accordingly.

README.md:1docker-compose.yml:5
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

api

Dubbo providervulnerability target

A Java service built from the provided source, running a Dubbo Spring Boot provider that listens on port 12345 and implements the DemoService interface.

docker-compose.yml:4-8Dockerfile:1-19src/dubbo-spring-boot-samples/auto-configure-samples/provider-sample/src/main/resources/application.properties:8-9src/dubbo-spring-boot-samples/auto-configure-samples/provider-sample/src/main/java/org/apache/dubbo/spring/boot/sample/provider/service/DefaultDemoService.java:30-62
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-1948

Insufficient evidence

The environment is labeled for CVE-2020-1948, but no exploit code, vulnerable library version, or specific deserialization trigger is visible in the supplied evidence. The README links to an external wiki for verification steps, which are not included.

README.md:1README.md:57-59
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and docker-compose must be installed to build and run the environment.README.md:49-51
  • The Dubbo provider must be running and listening on port 12345.README.md:27-29

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile or use the pre-built image.README.md:37-39
  2. Start the container with docker-compose, exposing port 12345.README.md:41-43
  3. Connect to the service via telnet on port 12345 to confirm it is running.README.md:29-33
  4. Follow the external wiki instructions to verify the CVE-2020-1948 vulnerability.README.md:57-59
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment only exposes a Dubbo service on a mapped port. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present. The README describes a standard vulnerability lab setup.

docker-compose.yml:1-9Dockerfile:1-19README.md:1-73
Review boundaries

What the analysis did not establish

  • No exploit payload or deserialization gadget is included; the actual vulnerability verification steps are external and not supplied.
  • The Dockerfile uses a non-official base image (szgx/java:8u111_debian) whose contents are uninspected.
  • The README references an external wiki for vulnerability verification, which is not part of the evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1