iveresk/cve-2022-21907

GitHubRepository PoC

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2022-21907Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a Go application from source that sends crafted HTTP POST requests to exploit CVE-2022-21907, a denial-of-service vulnerability in the Windows http.sys driver. The container runs the exploit against a target specified via an environment variable or build argument.

Dockerfile:1-23cve-2022-21907.go:1-65exploit/exploit.go:1-62

Lab assessment

Vulnerability lab

The repository name, README, and source code explicitly describe and implement an exploit for CVE-2022-21907. The Dockerfile builds and runs this exploit, making the environment a vulnerability research lab.

README.md:1-46cve-2022-21907.go:1-65exploit/exploit.go:1-62
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

cve-2022-21907 binary

exploit orchestrator

Go binary built from cve-2022-21907.go and exploit/exploit.go. It parses a target (IP or file of IPs) and repeatedly sends crafted HTTP POST requests with a malicious Accept-Encoding header to trigger a double free in http.sys.

Dockerfile:19-23cve-2022-21907.go:1-65exploit/exploit.go:1-62

golang:1.17-alpine base image

build environmentruntime environment

Provides the Go toolchain to compile the exploit and the runtime to execute it.

Dockerfile:5
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-21907

Supported by supplied evidence

The README, source code, and Dockerfile all reference CVE-2022-21907. The exploit sends a crafted Accept-Encoding header designed to trigger a double free in http.sys, matching the CVE description.

README.md:1-46exploit/exploit.go:14-16cve-2022-21907.go:1-65
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A target running a vulnerable version of Windows (e.g., Windows Server 2019 or Windows 10 version 1809 with HTTP Trailer Support enabled, or Windows 10 version 2004 build 19041.450) with port 80 accessible.README.md:40-44
  • A file containing target IPs (default input.txt) or a single target IP passed via the -t flag.Dockerfile:8-9cve-2022-21907.go:20-30

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile, optionally specifying a custom input file via --build-arg INPUT_FILE.README.md:24-30
  2. Run the container, which executes the exploit binary with the target file or IP.README.md:31Dockerfile:22-23
  3. The exploit sends crafted HTTP POST requests to the target(s) every 3 minutes, attempting to crash the http.sys driver.cve-2022-21907.go:48-63exploit/exploit.go:18-62
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The container only sends HTTP requests to a user-specified target. There is no evidence of host escape, persistence, credential theft, data destruction, or connections to external systems beyond the intended target. The vm-setup.sh script installs Docker and runs the container on a host, but that script is not part of the container's runtime behavior and is typical for lab setup.

Dockerfile:1-23cve-2022-21907.go:1-65exploit/exploit.go:1-62vm-setup.sh:1-4
Review boundaries

What the analysis did not establish

  • The packet does not include a docker-compose.yml or any orchestration manifest, so the environment is limited to a single Dockerfile.
  • The exploit's effectiveness depends on an external vulnerable target; the packet does not provide a vulnerable target or verify the exploit works.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1