Dockerfile
builds vulnerable Solr image
Defines a Docker image based on openjdk:11.0.9.1-jre-buster, installs lsof and procps, downloads and extracts Apache Solr 8.2.0, and sets the working directory to the Solr bin directory.
Dockerfile:1-14s-index/CVE-2020-13957
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Docker lab environments
1GitHubRepository root
Created Vuln labCVE-2020-13957Dockerfile
Analysis
Environment assessment
A Docker-based proof-of-concept environment for Apache Solr RCE vulnerability CVE-2020-13957. It builds a Solr 8.2.0 image on OpenJDK 11 JRE and provides instructions to start Solr Cloud and execute a remote code execution exploit via Velocity template injection.
README.md:1Dockerfile:1-14Lab assessment
Vulnerability labThe README explicitly describes a CVE-2020-13957 proof-of-concept, provides exploit steps, and the Dockerfile builds a vulnerable Solr version (8.2.0) to demonstrate the vulnerability.
README.md:1README.md:5Dockerfile:5Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
myconfigset.zip
malicious Solr ConfigSet
A binary zip file referenced in the README exploit steps as the ConfigSet to upload. Its contents are uninspected, but it is used to trigger the vulnerability.
README.md:37README.md
documentation and exploit guide
Provides setup and exploit instructions for the CVE-2020-13957 vulnerability, including Docker and Mac environments, and demonstrates remote code execution via curl commands.
README.md:1-119How the supplied evidence relates each vulnerability
CVE-2020-13957
Supported by supplied evidence
The README explicitly targets CVE-2020-13957, describes the vulnerability, and provides a working exploit against Solr 8.2.0, which falls within the affected version range (8.0.0 to 8.6.2).
README.md:1README.md:5README.md:9-11Requirements and sequence described by the evidence
Prerequisites
- Docker must be installed to build and run the container.
README.md:17 - The myconfigset.zip file must be present in the build context.
README.md:37 - Solr Cloud must be started inside the container.
README.md:27
Evidence-described exercise path
- Build the Docker image from the Dockerfile.
README.md:19 - Run a container from the image with port 8983 exposed and start a bash shell.
README.md:23 - Start Apache Solr Cloud inside the container.
README.md:27 - Upload the malicious ConfigSet (myconfigset.zip) via the Solr API.
README.md:37 - Create a new Solr collection using the uploaded ConfigSet.
README.md:43 - Execute the 'id' command via Velocity template injection to achieve RCE.
README.md:49
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior targets the lab's own Solr instance inside the container. The exploit executes 'id' within the container, which is expected for a vulnerability demonstration. No evidence of host escape, external connections, persistence, or credential theft is present.
README.md:49README.md:53What the analysis did not establish
- myconfigset.zip is a binary file and its contents are uninspected; it could contain additional unexpected payloads.
- The Dockerfile does not copy myconfigset.zip into the image, so the exploit step requires the file to be present on the host and accessible to curl, which is not explicitly documented.
- The README references a Mac demo that executes 'open -a calculator' on the host, but this is outside the Docker lab scope and not part of the containerized environment.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.