vigilante-1337/CVE-2023-29386

GitHubRepository PoC

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

safe-lab/docker_compose.yaml

Created Vuln labCVE-2023-29386Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a WordPress service with MariaDB, intended as a controlled lab for reproducing CVE-2023-29386.

safe-lab/docker_compose.yaml:1-42readme.md:1-108

Lab assessment

Vulnerability lab

The README explicitly states the environment is for reproducing CVE-2023-29386, a WordPress arbitrary file upload vulnerability, and provides instructions for deploying the lab and installing vulnerable plugins.

readme.md:1-3readme.md:47-60
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mariadb

database

MariaDB service providing the WordPress database, configured with root and user credentials.

safe-lab/docker_compose.yaml:4-14

exploitdev

web servervulnerable target

WordPress service with PHP 8.4 and Apache, exposed on port 80, intended to host the vulnerable Manager for Icomoon plugin.

safe-lab/docker_compose.yaml:16-32
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-29386

Supported by supplied evidence

The README describes the vulnerability as an unauthenticated arbitrary file upload in Manager for Icomoon < 2.1, and the lab includes a vulnerable plugin ZIP file for testing.

readme.md:1-3readme.md:47-60
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to deploy the lab.readme.md:47-50
  • After deployment, an administrator must log in to WordPress and manually upload and activate the vulnerable plugin from safe-lab/manager-for-icomoon.2.0.zip.readme.md:52-60

Evidence-described exercise path

  1. Clone the repository and navigate to the safe-lab directory.readme.md:47-50
  2. Start the lab with 'sudo docker compose up -d'.readme.md:50
  3. Complete WordPress setup and log in as administrator.readme.md:52-54
  4. Upload and activate the vulnerable plugin from safe-lab/manager-for-icomoon.2.0.zip.readme.md:55-57
  5. Exploit the unauthenticated arbitrary file upload vulnerability to achieve remote code execution.readme.md:1-3readme.md:11-13
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file defines a standard WordPress and MariaDB setup with no privileged mode, no host volume mounts beyond named Docker volumes, and no suspicious commands. The README explicitly warns to use the lab only in isolated environments. All behavior is directed at the contained lab target.

safe-lab/docker_compose.yaml:1-42readme.md:47-60
Review boundaries

What the analysis did not establish

  • The vulnerable plugin ZIP file (safe-lab/manager-for-icomoon.2.0.zip) is a binary and was not inspected.
  • The exploit binary referenced in the README is not included in the evidence packet and was not analyzed.
  • The packet does not include the actual exploit code or proof-of-concept, only the lab infrastructure.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1