redis
message broker
A Redis 7 Alpine container used as the message queue for Socket.IO server communication. It is not the target of the vulnerability.
docker-compose.yml:6-16locus-x64/CVE-2025-61765_PoC
PoC files
11 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact contains two Python scripts that construct and deliver malicious pickle payloads to exploit CVE-2025-61765, a remote code execution vulnerability in python-socketio. One script publishes payloads directly to a Redis message queue; the other sends them via HTTP to a webhook that forwards to Redis. Both scripts include payload classes that use __reduce__ to execute arbitrary shell commands on the target Socket.IO server upon deserialization.
Backdoor review
No backdoor observed in reviewed code
The PoC demonstrates the disclosed CVE-2025-61765 pickle deserialization vulnerability against a target python-socketio server. The payloads execute commands on the target server to create evidence files, gather system information, and optionally install an SSH key. All behavior is consistent with the stated exploit and no concealed or misrepresented harm to the operator or unrelated systems was found.
ClassificationExploit
Model confidence95%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
Both Python scripts actively construct and deliver malicious pickle payloads designed to achieve remote code execution on a vulnerable python-socketio server. The code includes complete exploit logic: payload classes with __reduce__ for command execution, serialization with pickle.dumps, and delivery mechanisms (direct Redis publish or HTTP webhook). This is exploit code, not merely a scanner or writeup.
socketio_server/poc.py:19-25socketio_server/poc.py:113-125poc.py:66-89Requirements
- Attacker must have prior access to the Redis message queue used by the python-socketio multi-server deployment.
README.md:3 - The target python-socketio server must be configured to use a Redis backend and be subscribed to the targeted channel.
socketio_server/poc.py:154-155
Observed behavior
- Defines a PickleRCE class with a __reduce__ method that returns (subprocess.check_output, (command,)) to execute arbitrary commands upon deserialization.
socketio_server/poc.py:19-25 - Defines an EvidencePayload class that uses __reduce__ to execute a bash command creating files in /tmp/evidence/ to prove compromise.
socketio_server/poc.py:27-45 - Serializes payload objects with pickle.dumps and publishes them to a Redis channel, targeting python-socketio servers that will deserialize them via pickle.loads.
socketio_server/poc.py:113-125 - The second script (poc.py) sends the same serialized pickle payloads via HTTP POST to a /webhook endpoint, which then forwards them to Redis.
poc.py:66-89
Behaviors behind the backdoor verdict
Observables
- Command Execution
- subprocess.call(['bash', '-c', 'mkdir -p /home/{username}/.ssh ...'])SSHBackdoorPayload in poc.py installs an operator-supplied SSH public key on the target server, which is the disclosed RCE impact.
poc.py:19-36 - Command Execution
- subprocess.call(['bash', '-c', 'mkdir -p /tmp/evidence && echo ...'])EvidencePayload and InfoGatheringPayload in socketio_server/poc.py create evidence files and collect system information on the target server, consistent with the exploit demonstration.
socketio_server/poc.py:27-65 - Network Connection
- http://localhost:6000The default webhook server URL in poc.py is localhost, indicating the operator runs the receiving server locally. No external data exfiltration is present.
poc.py:124
What the analysis did not establish
- Only 3 of 11 repository files were provided as text; 8 files are omitted. The omitted files may contain additional exploit variants, server code, or configuration.
- The evidence packet reports complete_artifact_coverage: false, so the full artifact content is not available for analysis.
- 8 files in the repository were not provided as text and were not analyzed; their content could contain additional behavior not visible in the reviewed evidence.
- The review does not assess whether the exploit works as claimed or whether the target server is actually vulnerable.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Model review verdict: Suspicious behavior.Vuln labCVE-2025-61765Compose · mixed
AnalysisSuspicious behavior
Environment assessment
A Docker Compose environment demonstrating CVE-2025-61765, a pickle deserialization vulnerability in python-socketio. It includes a Redis message broker, a vulnerable Socket.IO server, an edge server that acts as a webhook to publish payloads to Redis, and an attacker container that sends malicious pickle payloads to the edge server.
docker-compose.yml:1-86README.md:1-19Lab assessment
Vulnerability labThe README explicitly states it is a demo for CVE-2025-61765, a remote code execution vulnerability in python-socketio. The Dockerfiles, server code, and exploit scripts are all designed to set up and exploit this vulnerability in a controlled environment.
README.md:1-3Dockerfile.socketio_server:5socketio_server/server.py:1-228Lab shapeCompose · mixed
Services4
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
socketio_server
vulnerable target
A Python Socket.IO server using AsyncRedisManager, which automatically deserializes messages from Redis using pickle.loads(). This is the vulnerable component targeted by the exploit.
docker-compose.yml:19-40Dockerfile.socketio_server:1-30socketio_server/server.py:30-33edge_server
webhook relay
A Flask application that receives HTTP POST requests with pickle payloads and publishes them to the Redis channel. It acts as an intermediary, allowing the attacker to inject payloads into Redis without direct Redis access.
docker-compose.yml:43-57Dockerfile.edge_server:1-28edge_server/app.py:1-125attacker
exploit client
A Python container that runs poc.py to send malicious pickle payloads to the edge server's /webhook endpoint. It requires an SSH public key as an argument to create an SSH backdoor payload.
docker-compose.yml:60-76poc.py:1-168How the supplied evidence relates each vulnerability
CVE-2025-61765
Supported by supplied evidence
The environment is explicitly labeled as a demo for CVE-2025-61765. The vulnerable server uses python-socketio with AsyncRedisManager, which is documented to use pickle.loads() for deserialization, matching the vulnerability description.
Dockerfile.socketio_server:5socketio_server/server.py:30-33README.md:1-3Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose must be installed to build and run the environment.
README.md:11-13 - The attacker must provide an SSH public key via --ssh-key or --ssh-key-file argument to poc.py.
poc.py:120-123 - The edge_server must be running and accessible at the URL specified by the attacker (default http://localhost:6000).
poc.py:118
Evidence-described exercise path
- Start the environment with 'docker-compose up --build'. This builds and starts Redis, the vulnerable Socket.IO server, the edge server, and the attacker container.
README.md:11-13 - The attacker container automatically runs poc.py, which sends malicious pickle payloads (including an SSH backdoor) to the edge server's /webhook endpoint.
docker-compose.yml:72poc.py:1-168 - The edge server publishes the received payloads to the Redis 'socketio' channel.
edge_server/app.py:47-65 - The vulnerable Socket.IO server receives the message from Redis and automatically calls pickle.loads() on the payload, executing the embedded commands (e.g., creating evidence files, installing an SSH backdoor).
socketio_server/server.py:30-33poc.py:18-35 - Check the ./evidence directory on the host for files created by the exploit inside the socketio_server container.
docker-compose.yml:37-38README.md:17-19
Behaviors behind the stored safety assessment
Suspicious behavior
The attacker's poc.py includes an SSHBackdoorPayload class that writes a user-supplied SSH public key to /home/{username}/.ssh/authorized_keys on the target server. While this is a documented part of the exploit demonstration, it is a concrete host-impact action that modifies the target container's SSH configuration to enable persistent remote access. This goes beyond a simple proof-of-concept (e.g., creating a file in /tmp) and constitutes a real backdoor installation, which is a suspicious indicator even in a lab context.
poc.py:18-35Indicators requiring review
- The exploit payload SSHBackdoorPayload installs an SSH backdoor by appending a user-provided public key to authorized_keys, enabling persistent remote access to the compromised container.
poc.py:18-35
What the analysis did not establish
- The socketio_server/poc.py file is present but not used in the main exercise path; the attacker uses the root-level poc.py instead.
- The attacker container's entrypoint runs poc.py, but the command is 'tail -f /dev/null', which may cause the container to exit after the script finishes if not overridden.
- The edge_server's README.md describes a generic Redis publisher, not its specific role in the CVE demo.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.