theorzr/ensimag-secu3a-cve-2024-22416

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

compose.yaml

Created Vuln labCVE-2024-22416Compose · mixed

1 Compose manifest · 2 Dockerfiles · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that sets up a pyLoad server (version 0.5.0b3.dev76) and an attacker server serving a CSRF proof-of-concept page, intended to demonstrate CVE-2024-22416.

compose.yaml:1-15README.md:1-13

Lab assessment

Vulnerability lab

The README explicitly states the repository contains a Docker Compose configuration to test CVE-2024-22416, and the components (pyLoad server, attacker CSRF page) match a vulnerability reproduction environment.

README.md:1-8
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

pyload

vulnerable target

A pyLoad-ng 0.5.0b3.dev76 server built from python:3.10-alpine3.18, configured with debug mode and a web interface on port 8000. It exposes ports 8000 and 9666 to the host.

pyload/Dockerfile:1-5pyload/pyload.cfg:1-74compose.yaml:3-8

attacker

CSRF exploit delivery

An nginx:alpine server that serves a single csrf.html page. The page auto-submits a form to http://localhost:8000/api/add_user/ to add a user 'hacker'. It exposes port 80 mapped to host port 8001.

attacker/Dockerfile:1-2attacker/csrf.html:1-12compose.yaml:9-13
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-22416

Supported by supplied evidence

The environment is explicitly built to demonstrate CVE-2024-22416, as stated in the README. The CSRF page targets the pyLoad API to add a user, which aligns with the cross-site request forgery vulnerability described in the referenced advisory.

README.md:1-8attacker/csrf.html:4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:6-7
  • The user must log in to pyLoad at localhost:8000 with credentials pyload:pyload before triggering the CSRF.README.md:9-10

Evidence-described exercise path

  1. Run 'docker compose up' to start both services.README.md:6-7
  2. Navigate to localhost:8000 and log in with user 'pyload' and password 'pyload'.README.md:9-10
  3. Navigate to localhost:8001/csrf.html to trigger the CSRF attack, which adds a user 'hacker'.README.md:10-12
  4. Verify the attack by checking Settings > Users in pyLoad for the new 'hacker' user.README.md:12
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers. The CSRF attack targets the local pyLoad service within the Docker network, and no evidence shows host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.

compose.yaml:1-15attacker/csrf.html:4README.md:1-13
Review boundaries

What the analysis did not establish

  • The packet includes a binary file 'CVE #2.pdf' that is uninspected; its content and any potential malicious payload are unknown.
  • The CSRF page targets 'localhost:8000', which resolves inside the attacker container, not the host; the actual exploit path relies on the user's browser being on the host and the port mapping, but the Docker networking is not fully detailed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1