CVE-2025-53833 Exploit Metadata

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Technical assessment

The artifact is a Python 3 exploit script (poc/poc.py) that achieves unauthenticated Remote Code Execution (RCE) against LaRecipe versions < 2.8.1 by injecting Blade template directives via the HTTP query string. The script sends a raw HTTP GET request with a payload like {{system('id')}} and extracts the command output from the response.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits CVE-2025-53833, a Server-Side Template Injection (SSTI) vulnerability in LaRecipe, to achieve Remote Code Execution (RCE) on a target server. The script uses raw TCP sockets to send a crafted HTTP GET request containing a Blade template directive in the query string. The code is fully readable, contains no obfuscation, and its behavior is entirely consistent with the documented exploit. There is no evidence of any concealed, deceptive, or harmful behavior directed at the operator running the PoC.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPython

Target softwareLaRecipe

Attack typesServer-Side Template Injection (SSTI)Remote Code Execution (RCE)

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is poc/poc.py, which is explicitly described as a 'standalone RCE exploit' and 'PoC for CVE-2025-53833: LaRecipe SSTI to RCE'. Its code constructs and sends a malicious HTTP request to inject and execute arbitrary system commands on a vulnerable server, and it extracts the command output from the response. This is code intended to exercise a vulnerability, not merely detect it.

poc/poc.py:1-4poc/poc.py:18-22poc/poc.py:270-279README.md:176

Requirements

Target must be running a vulnerable version of LaRecipe (< 2.8.1) with the documentation endpoint accessible.poc/poc.py:7poc/poc.py:21-22
The documentation page must contain anchor links (href="#...") to trigger the vulnerable replaceLinks() method.poc/poc.py:297-301

Observed behavior

Sends a raw HTTP GET request to the target's documentation endpoint with a Blade SSTI payload in the query string.poc/poc.py:87-114poc/poc.py:150-180
Extracts the output of the executed system command from the HTTP response body by parsing anchor href attributes.poc/poc.py:222-253
Reports whether the target is vulnerable based on the presence of command output in the response.poc/poc.py:335-358

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection: Target host and port specified by operator via command-line arguments (default: 172.20.0.2:8000)The PoC connects to a user-specified target to deliver the exploit payload. This is the disclosed and expected behavior for a remote exploit.poc/poc.py:363-365
Command Execution: Operator-specified OS command executed on the target server via SSTIThe PoC injects a Blade directive containing the operator's command into the target's template engine, leading to RCE. This is the core of the disclosed exploit.poc/poc.py:68poc/poc.py:150-180

Review boundaries

What the analysis did not establish

The evidence packet includes only 4 of 11 reported files; 6 files are unclassified and 1 is non-text media, so the full artifact content is not available for analysis.
The analysis is based solely on the supplied text; the code was not executed, and its functionality is not verified.
The review is limited to the four text files provided in the evidence packet. Other files in the repository directory (e.g., Dockerfiles, shell scripts) were not included for review, but the core executable PoC logic is fully covered.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2025-53833/docker-compose.yml

Created 2026-05-19Vuln labCVE-2025-53833Compose · mixed

1 Compose manifest · 2 Dockerfiles · 2 services

Lab screenshot for CVE-2025-53833/docker-compose.yml

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Environment assessment

A Docker Compose lab for CVE-2025-53833, a Server-Side Template Injection (SSTI) vulnerability in LaRecipe. It defines two services: a vulnerable container running LaRecipe v2.8.0 and a patched container running v2.8.1, both serving documentation on internal port 8000 mapped to host ports 8081 and 8082 respectively.

CVE-2025-53833/docker-compose.yml:1-38CVE-2025-53833/README.md:1-199

Lab assessment

Vulnerability lab

The environment is explicitly designed to demonstrate and reproduce CVE-2025-53833, a Server-Side Template Injection vulnerability in LaRecipe. It includes a vulnerable container, a patched container for comparison, a proof-of-concept exploit script, and detailed documentation of the vulnerability and attack chain.

CVE-2025-53833/README.md:1-10CVE-2025-53833/docker-compose.yml:1-5CVE-2025-53833/poc/poc.py:1-30

Lab shapeCompose · mixed

Services2

Compose manifests1

Dockerfiles2

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable

vulnerable targetLaRecipe v2.8.0 server

A Docker container built from Dockerfile.vulnerable, running LaRecipe v2.8.0 with the SSTI vulnerability. It serves documentation on port 8000, mapped to host port 8081. The entrypoint starts a Laravel development server.

CVE-2025-53833/docker-compose.yml:8-17CVE-2025-53833/Dockerfile.vulnerable:1-44CVE-2025-53833/entrypoint.sh:1-16

patched

patched comparison targetLaRecipe v2.8.1 server

A Docker container built from Dockerfile.patched, running LaRecipe v2.8.1 with the SSTI fix. It serves documentation on port 8000, mapped to host port 8082. The entrypoint starts a Laravel development server.

CVE-2025-53833/docker-compose.yml:19-28CVE-2025-53833/Dockerfile.patched:1-44CVE-2025-53833/entrypoint.sh:1-16

poc.py

proof-of-concept exploit script

A Python 3 script that exploits the SSTI vulnerability by sending a raw HTTP GET request with a Blade directive in the query string to the vulnerable target. It extracts command output from the response to confirm RCE.

CVE-2025-53833/poc/poc.py:1-401CVE-2025-53833/README.md:120-150

setup.sh

build-time setup script

A shell script executed during Docker image build. It creates a Laravel project, installs the specified LaRecipe version, configures SQLite, publishes LaRecipe assets, patches ParsedownExtra for PHP 8.1 compatibility, and creates documentation files with anchor links required to trigger the vulnerability.

CVE-2025-53833/setup.sh:1-160

entrypoint.sh

container entrypoint

A shell script that sets permissions, clears compiled views, and starts the Laravel development server on 0.0.0.0:8000.

CVE-2025-53833/entrypoint.sh:1-16

php-lab.ini

PHP configuration

A PHP configuration file that increases memory limit and suppresses E_WARNING and E_DEPRECATED errors to work around PHP 8.1 compatibility issues with ParsedownExtra.

CVE-2025-53833/php-lab.ini:1-9

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-53833

Supported by supplied evidence

The packet explicitly associates CVE-2025-53833 with the LaRecipe SSTI vulnerability. The README, Dockerfiles, setup script, and PoC script all reference this CVE and describe the vulnerable code path (getRequestUri() in replaceLinks()) and the fix (getPathInfo()). The lab is structured to demonstrate this specific vulnerability.

CVE-2025-53833/README.md:1-10CVE-2025-53833/README.md:30-50CVE-2025-53833/Dockerfile.vulnerable:1-4CVE-2025-53833/Dockerfile.patched:1-3CVE-2025-53833/poc/poc.py:1-10

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed on the host.CVE-2025-53833/README.md:80-85
Host ports 8081 and 8082 available for mapping to the vulnerable and patched containers.CVE-2025-53833/docker-compose.yml:14-15CVE-2025-53833/docker-compose.yml:25-26
Python 3 available on the host to run the PoC script.CVE-2025-53833/README.md:120-125

Evidence-described exercise path

Build and start the lab containers using 'docker compose up -d'.CVE-2025-53833/README.md:80-85
Run the PoC script against the vulnerable container on host port 8081 with a command (e.g., 'id').CVE-2025-53833/README.md:88-90
Observe the command output in the response, confirming RCE.CVE-2025-53833/README.md:130-150
Run the PoC script against the patched container on host port 8082 to verify the fix blocks the exploit.CVE-2025-53833/README.md:92-94
Optionally, use curl for manual verification.CVE-2025-53833/README.md:96-100
Clean up with 'docker compose down'.CVE-2025-53833/README.md:102-104

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target container. The PoC script sends an SSTI payload to the vulnerable service to demonstrate RCE, which is the documented purpose of the lab. There is no evidence of host compromise, external communication, persistence, credential theft, data destruction, or any behavior beyond the stated exercise. The containers do not run in privileged mode, do not mount the Docker socket, and use an isolated bridge network.

CVE-2025-53833/docker-compose.yml:8-28CVE-2025-53833/poc/poc.py:1-401CVE-2025-53833/README.md:1-199

Review boundaries

What the analysis did not establish

The PoC verification report (poc_verification_report.md) is a placeholder and provides no additional evidence.
The packet does not include the actual LaRecipe source code or the vulnerable Documentation.php file; the vulnerability description relies on the README and PoC comments.
The CVE-2025-53833 identifier does not appear in public NVD or CVE databases as of the analysis date, but this does not affect the lab's internal consistency.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2025-53833