A Java service built from the provided source, running a Dubbo Spring Boot provider that listens on port 12345 and implements the DemoService interface.
The environment is labeled for CVE-2020-1948, but no exploit code, vulnerable library version, or specific deserialization trigger is visible in the supplied evidence. The README links to an external wiki for verification steps, which are not included.
README.md:1README.md:57-59
Exercise context
Requirements and sequence described by the evidence
Prerequisites
Docker and docker-compose must be installed to build and run the environment.README.md:49-51
The Dubbo provider must be running and listening on port 12345.README.md:27-29
Evidence-described exercise path
Build the Docker image using the provided Dockerfile or use the pre-built image.README.md:37-39
Start the container with docker-compose, exposing port 12345.README.md:41-43
Connect to the service via telnet on port 12345 to confirm it is running.README.md:29-33
Follow the external wiki instructions to verify the CVE-2020-1948 vulnerability.README.md:57-59
Safety-review evidence
Behaviors behind the stored safety assessment
No harmful behavior observed
The environment only exposes a Dubbo service on a mapped port. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present. The README describes a standard vulnerability lab setup.
No exploit payload or deserialization gadget is included; the actual vulnerability verification steps are external and not supplied.
The Dockerfile uses a non-official base image (szgx/java:8u111_debian) whose contents are uninspected.
The README references an external wiki for vulnerability verification, which is not part of the evidence packet.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.