Technical assessment
The artifact contains a Python script (poc/poc.py) that sends an HTTP GET request to a vulnerable nginx server's injected /pwned endpoint to trigger remote code execution via a Lua code block, executing OS commands like 'id' and 'hostname' and reading files.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of documentation, a lab setup guide, and two Python PoC scripts for CVE-2025-15566. The scripts demonstrate a legitimate nginx configuration injection vulnerability by sending HTTP requests to a locally running lab container and by simulating the vulnerable Go template function. No concealed executable behavior, operator-directed harm, persistence, credential theft, or unrelated payloads were observed. The scripts' actions are fully explained by the documented exploit chain and are consistent with normal PoC behavior for the stated CVE.
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareingress-nginx
Attack typesCode InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidenceClassification basis and observed behavior
Classification basis
The primary artifact, poc/poc.py, is designed to send a malicious HTTP request to trigger and verify the execution of injected Lua code on a remote server, which constitutes an exploit. The script's main purpose is to exercise the vulnerability, not just detect it.
poc/poc.py:2-6poc/poc.py:127-135CVE-LAB.md:9Requirements
- A vulnerable nginx instance with a pre-rendered configuration containing an injected /pwned Lua endpoint must be running and network-accessible.
poc/poc.py:15-24CVE-LAB.md:14-17
Observed behavior
- Sends an HTTP GET request to the /pwned endpoint on the target server.
poc/poc.py:136-141 - Parses the HTTP response body for evidence of command execution, such as the output of the 'id' command (e.g., 'uid=101(www-data)').
poc/poc.py:152-166 - Reports success if evidence of remote code execution is found in the response.
poc/poc.py:230-231
Behaviors behind the backdoor verdict
Observables
- Network Connection
- http://localhost:8080/The PoC script poc.py connects to a locally running lab container to verify the target is alive and to trigger the documented RCE endpoint.
poc/poc.py:80 - Network Connection
- http://localhost:8080/absorbThe PoC script poc.py checks for the existence of an injected nginx location as evidence of the configuration injection vulnerability.
poc/poc.py:104 - Network Connection
- http://localhost:8080/pwnedThe PoC script poc.py triggers the injected Lua RCE payload to demonstrate arbitrary command execution, which is the core of the CVE-2025-15566 exploit.
poc/poc.py:136 - Process Execution
- docker inspectThe PoC script poc.py uses docker inspect to dynamically resolve the IP address of the vulnerable lab container on the worker network.
poc/poc.py:49-50 - Process Execution
- docker compose logs go-testThe PoC script poc_vector2_template_injection.py retrieves Go unit test output from the lab container to provide evidence of the vulnerable function.
poc/poc_vector2_template_injection.py:178-180
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository unit were included in the analysis. The analysis is based on the 5 selected text files provided.
- The exploit targets a lab environment with a pre-rendered vulnerable configuration, not a live, unmodified ingress-nginx controller.
- The review is limited to the 5 text files provided in the evidence packet. 14 unclassified files totaling 72,353 bytes were present in the artifact but were not analyzed as they were flagged as binary or non-text media. The analysis scope confirms complete coverage for the selected readable text, but the artifact coverage is incomplete overall.
Model interpretationThis review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.