pouriam23/CVE-2016-5180-docker-

GitHubRepository PoC

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2016-5180Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-container Node.js web application that accepts a hostname via a form and performs a DNS resolution, described as a CTF challenge vulnerable to CVE-2016-5180.

Dockerfile:1-17package.json:1-13server.js:1-34

Lab assessment

Vulnerability lab

The package.json description explicitly states 'CTF vulnerable to CVE-2016-5180 (Node.js + c-ares)' and the server.js code passes user-supplied hostname directly to dns.resolve, which is the attack vector for CVE-2016-5180.

package.json:4server.js:21-22
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

node:0-slim base image

base operating system and Node.js runtime

Provides the Node.js 0.x runtime environment on a slim Debian base, which includes the vulnerable c-ares library.

Dockerfile:1

CTF web application (server.js)

vulnerable targetweb serverDNS resolver

An Express.js application serving a form at GET / and a POST /register endpoint that takes a 'callback' hostname and resolves it using dns.resolve without sanitization, enabling the CVE-2016-5180 vulnerability.

server.js:1-34
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2016-5180

Supported by supplied evidence

The environment uses Node.js 0.x (node:0-slim) which bundles a vulnerable c-ares version, and the application passes unsanitized user input to dns.resolve, matching the known attack vector for CVE-2016-5180 (a buffer overflow in c-ares).

Dockerfile:1server.js:21-22
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.Dockerfile:1-17
  • The container must be built and run, exposing port 3000.Dockerfile:14
  • An attacker must be able to send HTTP POST requests to the /register endpoint with a crafted hostname.server.js:18-22

Evidence-described exercise path

  1. Build the Docker image from the provided Dockerfile.Dockerfile:1-17
  2. Run the container, ensuring port 3000 is accessible.Dockerfile:14
  3. Send a POST request to /register with a crafted 'callback' hostname designed to trigger the buffer overflow in c-ares via dns.resolve.server.js:21-22
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The visible code only starts a web server on port 3000 and performs DNS resolution on user input. There is no evidence of host escape, external connectivity beyond DNS, persistence, credential theft, or destructive behavior. The behavior is entirely contained within the lab's intended vulnerability demonstration.

server.js:1-34Dockerfile:1-17
Review boundaries

What the analysis did not establish

  • No docker-compose.yml or runtime configuration is provided; port mapping and network mode are unspecified.
  • The exact exploit payload and its effect (e.g., crash vs. code execution) are not included in the evidence.
  • The base image 'node:0-slim' is outdated and may have other vulnerabilities, but only CVE-2016-5180 is assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1