pouriam23/DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

GitHubRepository PoC

PoC files

17 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created UncertainCVE-2025-43864Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A multi-stage Docker build for a React Router web application (my-react-router-app) using Node.js 20 Alpine. The build installs dependencies, builds the app, and produces a final image that runs the production server via 'npm run start'.

Dockerfile:1-22package.json:1-31

Lab assessment

Uncertain lab purpose

The repository name and CVE association suggest a vulnerability lab for CVE-2025-43864 (and possibly CVE-2025-43865), but the supplied evidence files (Dockerfile, package.json, application source) describe only a standard React Router application build and deployment. No exploit code, vulnerable configuration, or reproduction steps are visible in the provided text. The Dockerfile and application code appear to be a normal production build, not a vulnerability research environment.

Dockerfile:1-22package.json:1-31README.md:1-87
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

build specification

Defines a multi-stage build: installs all dependencies in 'development-dependencies-env', production dependencies in 'production-dependencies-env', builds the app in 'build-env', and assembles the final runtime image with only production dependencies and the build output. The final image runs 'npm run start'.

Dockerfile:1-22

package.json

application manifestdependency declaration

Declares the project as 'my-react-router-app', a private ES module. Defines scripts for build, dev, start, and typecheck. Lists runtime dependencies (@react-router/node, @react-router/serve, isbot, react, react-dom, react-router) and devDependencies including @react-router/dev, tailwindcss, typescript, vite, and react-router-devtools.

package.json:1-31

package-lock.json

dependency lock file

Locks exact versions of all dependencies and transitive dependencies for reproducible installs. Contains metadata for packages like @react-router/serve, express, compression, morgan, etc.

package-lock.json:1-6651

Application source (app/)

web application frontend

Contains React Router application code: root layout (root.tsx), route definitions (routes.ts, home.tsx), welcome component (welcome.tsx), CSS (app.css), and static assets (logos, favicon). The app renders a welcome page with links to React Router docs and Discord.

app/root.tsx:1-75app/routes.ts:1-3app/routes/home.tsx:1-13app/welcome/welcome.tsx:1-89

Configuration files (tsconfig.json, vite.config.ts, react-router.config.ts)

build configuration

TypeScript configuration targets ES2022 with strict mode and path aliases. Vite config uses tailwindcss, react-router, and tsconfig-paths plugins. React Router config enables server-side rendering (ssr: true).

tsconfig.json:1-27vite.config.ts:1-8react-router.config.ts:1-7

README.md

documentation

Provides standard instructions for installing, developing, building, and deploying the React Router application using Docker or other platforms. No vulnerability or exploit information is present.

README.md:1-87
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-43864

Insufficient evidence

The repository name and CVE association metadata reference CVE-2025-43864, but the supplied evidence files contain no information about this CVE, no exploit code, no vulnerable configuration, and no reproduction steps. The visible application is a standard React Router app with no indication of the described vulnerability (DoS via cache poisoning by forcing SPA mode).

Dockerfile:1-22package.json:1-31README.md:1-87
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image.README.md:47-49
  • The application source code and configuration files must be present in the build context.Dockerfile:2
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and application code describe a standard production build of a React Router web application. The final image runs 'npm run start' which starts the built server. No evidence of host escape, external connections beyond normal application dependencies, persistence mechanisms, credential theft, data destruction, or backdoor behavior is present. The application itself is a simple welcome page with no suspicious functionality.

Dockerfile:1-22package.json:1-31app/welcome/welcome.tsx:1-89
Review boundaries

What the analysis did not establish

  • The repository name and CVE association suggest a vulnerability lab, but no exploit or vulnerability reproduction code is visible in the supplied evidence.
  • The packet includes one binary file (public/favicon.ico) that was not inspected.
  • No Compose file or runtime configuration (e.g., port mappings, privileged mode) is provided, so the actual container runtime behavior cannot be fully assessed.
  • The CVE assessment is based solely on the absence of visible vulnerability-related content; the actual vulnerability may exist in the application dependencies or configuration not captured in the supplied text.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 1 binary file not inspected

Linked vulnerabilities

2