shiomiyan/CVE-2023-41080

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

compose.yml

Created Vuln labCVE-2023-41080Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs two Apache Tomcat containers (versions 9.0.79 and 9.0.80) with a custom web application and configuration files mounted from the host. The README indicates it is a demonstration of CVE-2023-41080, a URL parsing vulnerability in Tomcat.

compose.yml:1-20README.md:1-5

Lab assessment

Vulnerability lab

The environment is explicitly named after CVE-2023-41080, includes two Tomcat versions (vulnerable 9.0.79 and patched 9.0.80), and the README provides example URLs to demonstrate the vulnerability and the fix. This is a typical setup for a vulnerability reproduction lab.

compose.yml:1README.md:1-5
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

tomcat-9-0-79

vulnerable target

Tomcat 9.0.79 container serving a web application with FORM-based authentication. It is the vulnerable version for CVE-2023-41080. Exposes port 8081 on the host.

compose.yml:4-10README.md:1

tomcat-9-0-80

patched reference

Tomcat 9.0.80 container with the same configuration as the vulnerable version. It is the patched version for CVE-2023-41080. Exposes port 8082 on the host.

compose.yml:12-18README.md:3

web application (ROOT)

target web application

A simple web application with a login page (login.html), a protected resource (secret.html), and an error page (error.html). It uses FORM-based authentication with the role 'admin'.

webapps/ROOT/login.html:1-16webapps/ROOT/secret.html:1webapps/ROOT/error.html:1conf/web.xml:22-40

tomcat-users.xml

authentication configuration

Defines a user 'admin' with password 'admin' and role 'admin', used for the web application's authentication.

conf/tomcat-users.xml:56-57

web.xml

web application deployment descriptor

Standard Tomcat web.xml with added security constraints for the /secret.html resource, requiring the 'admin' role and using FORM-based authentication.

conf/web.xml:22-40
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-41080

Supported by supplied evidence

The README explicitly links the environment to CVE-2023-41080, provides example URLs demonstrating the vulnerability on the vulnerable version and the fix on the patched version, and references a GitHub advisory (GHSA-q3mw-pvr8-9ggc) which corresponds to this CVE.

README.md:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.compose.yml:1-20
  • The host must have the necessary files (compose.yml, conf/, webapps/) in the current directory.compose.yml:7-9

Evidence-described exercise path

  1. Start the environment with 'docker-compose up'.compose.yml:1-20
  2. Access the vulnerable Tomcat instance at http://localhost:8081//secret.html;@example.com to observe the redirect to an arbitrary site (https://example.com).README.md:1-2
  3. Access the patched Tomcat instance at http://localhost:8082//secret.html;@example.com to verify the vulnerability is fixed.README.md:3
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. It only exposes ports 8081 and 8082 on the host for local testing. There are no privileged mode, host network, or other escape mechanisms. The mounted files are standard configuration and a simple web application. No hidden or destructive behavior is visible.

compose.yml:1-20
Review boundaries

What the analysis did not establish

  • The packet does not include the actual exploit code or a detailed description of the vulnerability mechanism beyond the README examples.
  • The webapps/ROOT directory may contain additional files not included in the evidence, but only the listed files are visible.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1