nopdata/cve-2020-28948

GitHubRepository PoC

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2020-28948Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds an Ubuntu 18.04 container with Apache, PHP 7.2, and the PEAR Archive_Tar 1.4.10 package. The container is run in privileged mode with port 80 exposed. Two binary files (Archive_Tar-1.4.10.tgz and exploit.zip) are copied into the image. The README references CVE-2020-28948 and links to a proof-of-concept for CVE-2020-28948 and CVE-2020-28949.

docker-compose.yml:1-12Dockerfile:1-10README.md:1-3

Lab assessment

Vulnerability lab

The README explicitly names CVE-2020-28948 and links to a proof-of-concept for that CVE and CVE-2020-28949. The Dockerfile installs a specific vulnerable version of Archive_Tar (1.4.10) and copies an exploit.zip into the container, consistent with a vulnerability reproduction or exercise environment.

README.md:1-3Dockerfile:7-9
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable target serviceApache web serverPHP 7.2 runtime

A single service built from the Dockerfile. It runs Apache with PHP 7.2 and the PEAR Archive_Tar 1.4.10 package. The container is started in privileged mode, exposes port 80, and executes a command that restarts Apache then opens an interactive bash shell.

docker-compose.yml:4-12Dockerfile:1-10
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-28948

Insufficient evidence

The README and docker-compose hostname reference CVE-2020-28948, and the Dockerfile installs Archive_Tar 1.4.10, which is plausibly vulnerable. However, no exploit code or vulnerability details are visible in the supplied text; the exploit.zip is binary and uninspected. The association cannot be confirmed or contradicted from the visible evidence alone.

README.md:1-3docker-compose.yml:5Dockerfile:8-9
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.docker-compose.yml:1-12
  • The host must allow privileged containers and port 80 binding.docker-compose.yml:8-9

Evidence-described exercise path

  1. Build and start the container using docker-compose, which restarts Apache and opens a bash shell.docker-compose.yml:10-12
  2. The exploit.zip is present in /srv; presumably the user extracts and executes it to demonstrate the vulnerability, but the exact steps are not visible in the supplied text.Dockerfile:9
Safety-review evidence

Behaviors behind the stored safety assessment

Suspicious behavior

The container is run with privileged: true, which grants extensive host access and is a common escape vector. The command opens an interactive bash shell with tty: true, and the exploit.zip binary is uninspected. While these may be intended for the lab exercise, the combination of privileged mode, interactive shell, and an uninspected binary payload raises concrete safety concerns beyond the documented lab target.

docker-compose.yml:8-12Dockerfile:9

Indicators requiring review

  • The service is run in privileged mode, which gives the container elevated capabilities and potential host escape paths.docker-compose.yml:8
  • An interactive bash shell is opened with tty: true, providing a persistent interactive session that could be used for unintended host access.docker-compose.yml:10-12
  • The exploit.zip binary is copied into the container and is uninspected; its behavior is unknown and could include host compromise or external communication.Dockerfile:9
Review boundaries

What the analysis did not establish

  • exploit.zip is binary and uninspected; its actual behavior is unknown
  • Archive_Tar-1.4.10.tgz is binary and uninspected; its exact contents are not verified
  • No exploit code or detailed vulnerability steps are visible in the supplied text
  • The README references a POC link but the link content is not included in the evidence
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 2 binary files not inspected

Linked vulnerabilities

1