Chocapikk/CVE-2024-7954

GitHubRepository PoC

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2024-7954Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a SPIP 4.2.12 web application with a MariaDB database, intended as a vulnerable target for an unauthenticated RCE exploit.

docker-compose.yml:1-34

Lab assessment

Vulnerability lab

The README explicitly describes the repository as containing an exploit for a Remote Code Execution vulnerability in SPIP up to 4.2.12, and the Docker Compose file sets up a SPIP 4.2.12 instance for testing.

README.md:1-3README.md:9-11docker-compose.yml:12
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database server

MariaDB 10.5 database service for the SPIP application, configured with root and application credentials.

docker-compose.yml:4-11

app

vulnerable web application

SPIP 4.2.12 web application exposed on host port 8880, configured to auto-install and connect to the db service.

docker-compose.yml:13-25

exploit.py

exploit script

Python script that sends crafted payloads to the SPIP porte_plume_previsu endpoint to achieve remote code execution, and provides an interactive shell.

exploit.py:1-242

spip_porte_plume_previsu_rce.rb

Metasploit exploit module

Metasploit module implementing the same RCE vulnerability for SPIP, with version detection and payload delivery.

spip_porte_plume_previsu_rce.rb:1-127
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-7954

Insufficient evidence

The repository name and README associate the exploit with CVE-2024-7954, but the Metasploit module uses a placeholder 'CVE-2024-XXXX' and no CVE details or references are provided in the evidence to confirm the association.

spip_porte_plume_previsu_rce.rb:30README.md:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the vulnerable environment.README.md:13
  • The SPIP instance must be accessible on the network (default http://localhost:8880).README.md:47-48
  • Python dependencies listed in requirements.txt must be installed to run exploit.py.requirements.txt:1-6

Evidence-described exercise path

  1. Set up the vulnerable SPIP instance using the provided Docker Compose file.README.md:45
  2. Ensure the SPIP instance is accessible on the local network.README.md:46
  3. Run the Python exploit script against the target URL to gain an interactive shell.README.md:47-48README.md:63-65
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit targets the lab's own SPIP container via the mapped port 8880, which is expected for a vulnerability lab. No evidence of host escape, external connections, persistence, or hidden malicious behavior is present.

docker-compose.yml:24exploit.py:1-242
Review boundaries

What the analysis did not establish

  • The Metasploit module contains a placeholder CVE reference ('CVE-2024-XXXX') and does not confirm the specific CVE-2024-7954 association.
  • No CVE details or external references are provided in the evidence to validate the vulnerability claim.
  • The exploit scripts are uninspected for any hidden behavior beyond the described RCE payload.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1