iveresk/cve-2022-30525

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2022-30525Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-container Docker environment based on golang:1.17-alpine that builds and runs a Go exploit tool targeting CVE-2022-30525 in Zyxel firewalls.

Dockerfile:1-24README.md:1-48

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2022-30525, a vulnerability in Zyxel firewalls, and the Dockerfile builds a Go program that sends crafted POST requests to exploit it. The repository name and module name both reference the CVE.

README.md:1-5cve-2022-30525.go:1-80go.mod:1-2
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

build environmentexecution environment

Defines a container based on golang:1.17-alpine, copies source code, builds the Go binary /cve-2022-30525, and runs it with a target file specified by INPUT_FILE.

Dockerfile:1-24

cve-2022-30525.go

exploit launcher

Main Go program that reads a target (URL or file of IPs) and a cmds file, then iterates over targets and commands, calling exploit.SendPOST to send crafted requests to the Zyxel ZTP handler.

cve-2022-30525.go:1-80

exploit/exploit.go

exploit payload sender

Go package that constructs a JSON payload with a command injection in the 'mtu' field and sends it via HTTPS POST to /ztp/cgi-bin/handler, ignoring SSL certificate errors.

exploit/exploit.go:1-69

cmds

command list

A file (not included in the packet) that contains commands to be injected; the main program reads it at runtime.

cve-2022-30525.go:47-48README.md:30-35

input

target specification

A file (not included in the packet) that can contain a list of target IPs/URLs; used when the -t argument is a file path.

cve-2022-30525.go:40-46Dockerfile:6-7
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-30525

Supported by supplied evidence

The README describes CVE-2022-30525 as an unauthenticated command injection in Zyxel firewalls via /ztp/cgi-bin/handler, and the exploit code sends a POST request to that exact endpoint with a command injection in the 'mtu' parameter, matching the curl example provided.

README.md:1-5README.md:14-19exploit/exploit.go:20-28exploit/exploit.go:30-50
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A cmds file must exist in the working directory containing commands to inject.cve-2022-30525.go:47-48README.md:30-35
  • A target URL or a file (input) containing target IPs/URLs must be provided via the INPUT_FILE environment variable or -t flag.Dockerfile:6-7cve-2022-30525.go:32-46
  • The target must be a Zyxel firewall with the vulnerable ZTP handler accessible over HTTPS.README.md:1-5exploit/exploit.go:30-50

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-24
  2. Run the container with an INPUT_FILE environment variable pointing to a target URL or file.README.md:40-42Dockerfile:6-7
  3. The container executes /cve-2022-30525 -t <INPUT_FILE>, which reads cmds and sends exploit POST requests to each target.Dockerfile:22-24cve-2022-30525.go:32-80
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The container only sends HTTP POST requests to targets specified by the user. It does not modify the host filesystem, open host shells, connect to external systems beyond the specified targets, persist data, steal credentials, or exhibit any hidden destructive behavior. The exploit is directed at the intended lab target (Zyxel firewalls).

cve-2022-30525.go:1-80exploit/exploit.go:1-69Dockerfile:1-24
Review boundaries

What the analysis did not establish

  • The cmds and input files are referenced but not included in the packet, so their contents are unknown.
  • The Dockerfile uses ADD . ./ which copies the entire build context, but the .gitignore excludes cmds and input, so they may not be present in the built image unless provided at runtime.
  • No Compose file is present; port mappings, privileged mode, or volume mounts are not specified, so the container's network access depends on the runtime configuration.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1