A Docker-based front-end application that executes the OIDC authorization code flow against a Keycloak instance and implements a session hijacking mechanism by allowing an attacker to substitute the session_id obtained from a victim's request, which is the core of CVE-2023-0264.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, a README, and a shell script for a proof-of-concept (PoC) front-end for CVE-2023-0264. The files describe a legitimate OIDC session hijacking demonstration tool. No concealed executable behavior, deceptive payloads, persistence mechanisms, credential theft, or unrelated remote access were observed. The shell script generates a configuration file from environment variables, which is standard practice. The README explicitly states the tool is for authorized testing on the user's own Keycloak instance.
The artifact is explicitly described as a 'PoC' that 'exposes the session_id hijacking hook' and allows a user to 'substitute' a session_id, which is the active exploitation of CVE-2023-0264, not just detection or scanning.
README.md:1README.md:3-4README.md:38-40
Requirements
Requires a running Keycloak instance with a specific realm and client configured, and the attacker must be able to obtain a victim's session_id.README.md:20-28README.md:38-39
Observed behavior
Serves a static web page that initiates an OIDC login flow to a Keycloak instance.README.md:3-4README.md:37
After the OIDC redirect, a prompt allows the user to view and replace the current session_id with a different one, enabling session hijacking.README.md:38-40
The application's configuration (Keycloak URL, realm, client ID) is dynamically generated at container startup from environment variables.docker-entrypoint.d/40-poc-config.sh:2-4docker-entrypoint.d/40-poc-config.sh:11-16
Safety-review evidence
Behaviors behind the backdoor verdict
Observables
Default Keycloak Url
https://147.93.70.139:8443The shell script sets a default Keycloak URL pointing to a specific IP address. This is a configuration default, not a backdoor, and is overridable via environment variables.docker-entrypoint.d/40-poc-config.sh:7
Review boundaries
What the analysis did not establish
The main application logic (index1.html) is not included in the provided text files, so the exact client-side code for the session_id substitution cannot be analyzed.
The evidence only includes the Dockerfile, README, and a shell script; the core exploit code is missing.
Four files in the repository (total 7 files) were not included in the text evidence; their content is unknown. The analysis scope covers only the three provided text files.
The actual HTML/JavaScript front-end code (index1.html) is not included in the evidence, so its runtime behavior cannot be verified.
No binary files were analyzed; the binary policy is metadata-only.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A single-service Docker Compose environment that builds and runs a static front-end PoC for CVE-2023-0264 (OIDC session hijacking). The front-end is served by nginx:alpine on port 5174 and connects to an external Keycloak instance at 147.93.70.139:8443.
The README explicitly describes the unit as a PoC for CVE-2023-0264, detailing the session-hijacking hook and the required Keycloak configuration. The Dockerfile and Compose file serve a static front-end that implements the OIDC authorization code flow with a prompt to substitute the session ID, which is the core of the demonstrated vulnerability.
A container built from nginx:alpine that serves a static HTML/JS application. The application implements the OIDC authorization code flow against a Keycloak instance, and includes a preInitHook that prompts the user to replace the session_id in the authorization code, demonstrating CVE-2023-0264. Keycloak connection parameters are injected at runtime via a generated config.js.
The README and the index1.html code explicitly describe and implement a session-hijacking hook that allows substituting the session_id in the OIDC authorization code, which matches the description of CVE-2023-0264 (Keycloak session hijacking via code injection).
README.md:1-50index1.html:220-250
Exercise context
Requirements and sequence described by the evidence
Prerequisites
A running Keycloak instance accessible at https://147.93.70.139:8443 with realm 'poc' and client 'client1' configured with valid redirect URIs and web origins for the PoC front-end.README.md:15-24docker-compose.yml:13-15
The user must accept the self-signed certificate of the Keycloak instance in their browser before using the PoC.README.md:26-29
The host running the PoC must have Docker and Docker Compose installed, and port 5174 must be reachable by the user's browser.README.md:7-12
Evidence-described exercise path
Start the PoC front-end with 'docker compose up -d --build'.README.md:7-9
Open http://maquina:5174 in a browser; the application redirects to the Keycloak login page.README.md:31-32index1.html:300-320
After authentication, Keycloak redirects back with an authorization code in the URL fragment. The preInitHook parses the code, extracts the session_id, and prompts the user to replace it with a target session ID.index1.html:220-250README.md:32-34
If a new session ID is provided, the code is modified and the page reloads with the hijacked session, completing the token exchange and demonstrating the vulnerability.index1.html:240-250README.md:34-36
Safety-review evidence
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the intended lab target: the PoC front-end connects to the specified external Keycloak instance to demonstrate the session-hijacking vulnerability. There is no evidence of host escape, persistence, credential theft, data destruction, unexplained payloads, or backdoor behavior. The port mapping (5174:80) and environment variables are necessary for the lab's operation.
The packet does not include the 'agente/' directory referenced in the README, so the detection component is absent.
The Keycloak instance at 147.93.70.139:8443 is external and not part of the supplied evidence; its configuration and safety cannot be assessed.
The Docker Compose file uses 'restart: unless-stopped', which could keep the container running across reboots, but this is a common operational choice and not inherently malicious.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.