EQSTLab/CVE-2025-1302

GitHubRepository PoC

PoC files

22 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2025-1302Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-container Docker environment based on node:22 that serves a Node.js Express web application on port 3000. The application uses jsonpath-plus 10.2.0 and exposes a /query endpoint that accepts user-supplied JSONPath expressions. The repository also includes a Python exploit script (CVE-2025-1302.py) that sends a crafted payload to the /query endpoint to achieve remote code execution via a reverse shell.

Dockerfile:1-23server.js:1-53CVE-2025-1302.py:1-124

Lab assessment

Vulnerability lab

The README explicitly describes the repository as a PoC for CVE-2025-1302, a remote code execution vulnerability in jsonpath-plus. The Dockerfile builds a container running a vulnerable version of jsonpath-plus (10.2.0, as specified in package.json). The server.js code passes user input directly to JSONPath without sanitization, and the included Python script demonstrates exploitation by sending a reverse shell payload. This is a self-contained vulnerability reproduction environment.

README.md:1-51package.json:1-15server.js:37-47CVE-2025-1302.py:1-124
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Node.js Express server (server.js)

vulnerable target application

An Express server listening on port 3000. It serves static files from the 'public' directory and provides two API endpoints: GET /data returns a hardcoded guestbook object, and POST /query accepts a JSON body with a 'path' field and passes it directly to JSONPath({path, json:message}) without sanitization, enabling JSONPath injection.

server.js:1-53

Python exploit script (CVE-2025-1302.py)

exploit demonstration tool

A Python command-line tool that sends a crafted JSONPath payload to a target URL's /query endpoint. The payload uses the JSONPath-plus constructor/prototype chain to execute a bash reverse shell command connecting back to a user-supplied IP and port. It includes a banner, spinner, and argument parsing for URL, LHOST, and LPORT.

CVE-2025-1302.py:1-124

Dockerfile

container build specification

Defines a Docker image based on node:22, installs npm dependencies (including jsonpath-plus 10.2.0), installs net-tools and netcat-openbsd, copies the application code, and exposes port 3000. The CMD runs node server.js.

Dockerfile:1-23

package.json

dependency manifest

Declares the application name 'jsonpath-test' and its dependencies, including the vulnerable jsonpath-plus version 10.2.0.

package.json:1-15

Frontend (public/index.html, public/js/index.js, public/css/index.css)

web user interface

A simple search page that allows users to enter a search term, which is sent as a JSONPath expression to the /query endpoint. It displays results in a table and includes floating character images for visual effect.

public/index.html:1-31public/js/index.js:1-97public/css/index.css:1-127

requirements.txt

Python dependency manifest

Lists the Python packages required to run the exploit script: requests, Faker, and rich_click.

requirements.txt:1-3
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-1302

Supported by supplied evidence

The README describes CVE-2025-1302 as an RCE in jsonpath-plus before 10.3.0 due to improper input sanitization. The package.json pins jsonpath-plus to 10.2.0, and server.js passes unsanitized user input to JSONPath. The exploit script demonstrates RCE via a reverse shell payload. The evidence directly supports the claimed vulnerability.

README.md:1-51package.json:1-15server.js:37-47CVE-2025-1302.py:1-124
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the vulnerable container.README.md:10-13
  • Python 3 and the packages in requirements.txt (requests, Faker, rich_click) must be installed to run the exploit script.README.md:27-30requirements.txt:1-3
  • A netcat listener must be started on the attacker's machine to receive the reverse shell.README.md:32-34
  • The target URL must point to the /query endpoint of the running vulnerable application.CVE-2025-1302.py:68-72

Evidence-described exercise path

  1. Build the Docker image: docker build -t jsonpath:10.2.0 .README.md:11
  2. Run the container: docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0README.md:12
  3. Start a netcat listener on the attacker's machine: nc -l -p <LPORT>README.md:33
  4. Run the exploit script: python3 CVE-2025-1302.py -u <URL_TO_EXPLOIT> -i <LHOST> -p <LPORT>README.md:34
  5. The exploit sends a JSONPath payload to the /query endpoint, which triggers RCE and connects a reverse shell back to the attacker's listener.CVE-2025-1302.py:68-82
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target container. The exploit script sends a reverse shell payload to the /query endpoint of the intentionally vulnerable application, which is the expected exercise. There is no evidence of hidden behavior, host escape, external exfiltration, persistence, credential theft, or destruction. The Dockerfile installs netcat-openbsd, which is consistent with receiving a reverse shell inside the container for demonstration purposes. No suspicious indicators are present.

CVE-2025-1302.py:68-82Dockerfile:1-23README.md:1-51
Review boundaries

What the analysis did not establish

  • The packet includes 3 uninspected binary PNG files and 10 oversized PNG files that were not analyzed; their content could theoretically contain hidden payloads, but no evidence suggests this.
  • The Dockerfile installs netcat-openbsd, which could be used for purposes beyond the lab, but its presence is consistent with the documented reverse shell demonstration.
  • The analysis does not verify whether the exploit actually achieves RCE or whether the CVE association is technically accurate beyond the provided evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 3 binary files not inspected

Linked vulnerabilities

1