KrE80r/CVE-2024-44902-env

GitHubRepository PoCScanner

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a deliberately vulnerable ThinkPHP environment designed for validating a nuclei template scanner. It contains a vulnerable application with insecure deserialization endpoints but no exploit or scanner code itself.

Backdoor review

No backdoor observed in reviewed code

The repository is a deliberately vulnerable ThinkPHP environment for CVE-2024-44902 validation. The reviewed text files (README, controllers, route) describe and implement the intended insecure deserialization vulnerability. No concealed backdoor, deceptive payload, or operator-directed harm is present in the supplied evidence.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPHP
Target softwareThinkPHP
Attack typesInsecure Deserialization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a vulnerable environment for validating a nuclei template, as stated in the README. It contains no exploit or scanner code; the nuclei template is referenced but not included. The application code only provides the vulnerable target.

README.md:3README.md:40

Requirements

  • A nuclei template (CVE-2024-44902.yaml) must be supplied externally to perform the scan.README.md:40

Observed behavior

  • The application exposes two endpoints (/api/sync and /api/import) that unserialize user-supplied data, simulating a vulnerable target for a scanner.app/controller/Api.php:38app/controller/Api.php:64
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Endpoint
/api/import?data=<serialized_payload>The README and route file define this endpoint, and the Api controller implements it with unserialize(urldecode($data)). This is the documented CVE-2024-44902 vulnerability, not a backdoor.README.md:54route/app.php:10app/controller/Api.php:56-64
Vulnerable Endpoint
/api/sync?payload=<base64_serialized_payload>The route file and Api controller implement this endpoint with unserialize(base64_decode($payload)). This is the documented CVE-2024-44902 vulnerability, not a backdoor.route/app.php:9app/controller/Api.php:27-38
Review boundaries

What the analysis did not establish

  • The nuclei template (CVE-2024-44902.yaml) is not included in the evidence; only the vulnerable target application is provided.
  • Two text files (likely configuration files) are omitted from the evidence, but their absence does not affect the classification of the primary artifact as a vulnerable environment.
  • Two files (Dockerfile, docker-compose.yml) were omitted from text analysis; their metadata shows no executable payloads, but their content was not reviewed.
  • Binary analysis was not performed; the artifact may contain unexamined binary content in the omitted files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2024-44902Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a ThinkPHP 8.0.4 web application with a deliberately vulnerable API controller. The environment is intended for validating a nuclei template for CVE-2024-44902, an insecure deserialization vulnerability.

README.md:1-3docker-compose.yml:1-4

Lab assessment

Vulnerability lab

The README explicitly states the environment is a 'Vulnerable environment for nuclei-templates validation' and 'DELIBERATELY VULNERABLE environment for security testing ONLY'. The Dockerfile and application code implement a ThinkPHP instance with an endpoint that calls unserialize() on user input, matching the described CVE-2024-44902.

README.md:1-3README.md:85-90app/controller/Api.php:30-35
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

thinkphp service

vulnerable web applicationnuclei template validation target

A single Docker Compose service built from the local Dockerfile. It exposes port 8080 on the host, mapping to container port 80. The service runs a ThinkPHP 8.0.4 application with Apache, intended to be tested with a nuclei template for CVE-2024-44902.

docker-compose.yml:10-20README.md:1-3

Dockerfile

builds the vulnerable ThinkPHP image

Starts from php:8.0.7-apache, installs Memcached extension, creates a ThinkPHP project with topthink/framework:8.0.4, copies custom application code (app/ and route/), and configures Apache to serve the public directory.

Dockerfile:1-46

Api controller

vulnerable endpointdeserialization sink

A PHP controller with two methods (sync and import) that accept user-supplied data and pass it to unserialize(). The import method is explicitly called out in the README as the vulnerable endpoint.

app/controller/Api.php:1-74README.md:55

Index controller

health check / landing page

A simple controller that returns an HTML string indicating the application is running. Provides a basic check that the service is up.

app/controller/Index.php:1-14

Route configuration

defines URL routing

Maps the root path to Index/index and creates an 'api' group with routes for 'sync' and 'import' that accept any HTTP method, matching the vulnerable controller methods.

route/app.php:1-14
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-44902

Supported by supplied evidence

The environment matches the CVE description: it runs ThinkPHP 8.0.4 (an affected version), has the Memcached extension installed, and provides an endpoint that unserializes user input, which is the described vulnerability.

Dockerfile:16Dockerfile:26-28app/controller/Api.php:30-35README.md:13-17
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:27-30
  • The nuclei tool and the CVE-2024-44902.yaml template are required to test the vulnerability.README.md:35-37

Evidence-described exercise path

  1. Clone the repository and start the environment with 'docker compose up -d'.README.md:27-30
  2. Verify the application is running by accessing http://localhost:8080/.README.md:35-36
  3. Run the nuclei template against the target: 'nuclei -t CVE-2024-44902.yaml -u http://localhost:8080'.README.md:37
  4. Optionally test the vulnerable endpoint directly with a serialized payload via /api/import?data=...README.md:55
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target. The Dockerfile builds a deliberately vulnerable ThinkPHP instance, the Compose file maps a port for local testing, and the application code implements the described deserialization sink. No hidden, destructive, or external actions are present. The README explicitly warns against production use and states the environment is for security testing only.

README.md:85-90docker-compose.yml:10-20Dockerfile:1-46
Review boundaries

What the analysis did not establish

  • The nuclei template CVE-2024-44902.yaml is referenced but not included in the evidence packet.
  • The actual exploit payload and gadget chain are described in the README but not provided as a file.
  • The Dockerfile uses archive.debian.org repositories, which may cause build failures if those archives become unavailable.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1