EQSTLab/CVE-2025-29927

GitHubRepository PoC

PoC files

28 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

next15

Created Vuln labCVE-2025-29927Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized Next.js 15.1.7 application with a middleware that blocks access to /admin paths. The homepage explicitly instructs bypassing the middleware by injecting an x-middle-subrequest header, suggesting a vulnerability reproduction environment for CVE-2025-29927.

next15/Dockerfile:1-6next15/pages/index.tsx:1-47next15/middleware.ts:1-20

Lab assessment

Vulnerability lab

The repository is named CVE-2025-29927, the homepage provides step-by-step exploit instructions using the x-middle-subrequest header, and the middleware is configured to block /admin paths, creating a target for the bypass. This is consistent with a vulnerability reproduction lab.

next15/pages/index.tsx:33-42next15/middleware.ts:8-10
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Next.js application

vulnerable targetweb application

A Next.js 15.1.7 app with a middleware that returns 401 for /admin paths unless isAuthenticated is true (hardcoded false). The homepage describes how to bypass the middleware using the x-middle-subrequest header.

next15/package.json:12next15/middleware.ts:5-19next15/pages/index.tsx:33-42

Docker environment

containerizationlab infrastructure

A Dockerfile based on node:22 that copies the application source, installs dependencies, exposes port 3000, and runs the Next.js dev server.

next15/Dockerfile:1-6
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-29927

Supported by supplied evidence

The repository name, the middleware bypass instructions on the homepage, and the use of Next.js 15.1.7 (a version potentially affected by CVE-2025-29927) all align with demonstrating this CVE.

next15/pages/index.tsx:33-42next15/package.json:12
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.next15/Dockerfile:1
  • The application must be running (npm run dev) and accessible on port 3000.next15/Dockerfile:5-6

Evidence-described exercise path

  1. Build and run the Docker container.next15/Dockerfile:1-6
  2. Send a request to the /admin path with the x-middle-subrequest header injected to bypass the middleware.next15/pages/index.tsx:33-42
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The visible behavior is limited to a Next.js dev server inside a container. The middleware bypass is the intended lab exercise. No evidence of host escape, external connections, persistence, credential theft, or destructive actions was found.

next15/Dockerfile:1-6next15/middleware.ts:1-20next15/pages/index.tsx:1-47
Review boundaries

What the analysis did not establish

  • Two binary files (eqst.png, favicon.ico) are uninspected; their content is unknown.
  • Seven oversized image files are omitted from analysis; their content is unknown.
  • No Compose file is present; port mapping and privileged mode cannot be assessed.
  • The packet does not include runtime instructions or a docker-compose.yml, so the exact container invocation is unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 2 binary files not inspected

Linked vulnerabilities

1