CVE-2025-59060 Exploit Metadata

PoC files

24 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

The artifact contains multiple Python and Java scripts that demonstrate a TLS hostname verification bypass (CVE-2025-59060) in Apache Ranger. The primary PoC (poc.py) sets up a rogue TLS server with a crafted certificate chain, connects to it remotely, and uses a Python port of the vulnerable Java logic to show that hostname verification is bypassed when a target hostname is found in an intermediate CA certificate's SAN. Additional vectors test the actual Java verifier classes over a real TLS connection and confirm a second vulnerable code path.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation, Python PoC scripts, and a verification report for CVE-2025-59060, a TLS hostname verification bypass in Apache Ranger. All code performs expected vulnerability demonstration behavior: starting a rogue TLS server, connecting to it, and comparing vulnerable vs. fixed hostname verification logic. No concealed executable behavior, credential theft, persistence, unrelated payloads, or operator-directed harm was observed.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPythonJava

Target softwareApache Ranger

Attack typesMan-in-the-Middle (MITM)TLS Hostname Verification Bypass

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact (poc.py) is classified as an exploit because it actively exercises the vulnerability by setting up a rogue TLS server, establishing a remote TLS connection, and demonstrating that the hostname verification is bypassed. The code is intended to prove the vulnerability can be exploited, not merely to detect its presence.

poc/poc.py:1-10poc/poc.py:354-364poc/poc.py:415-425

Requirements

Requires a MITM network position between Apache Ranger and a NiFi/NiFi Registry server.README.md:217-218
Requires a crafted certificate chain where an intermediate CA certificate contains a SAN matching the target hostname.README.md:219-220
Requires Docker and Docker Compose to build and run the lab environment.README.md:66-67

Observed behavior

Starts a rogue TLS server inside a Docker container that presents a crafted certificate chain (leaf SAN=attacker.com, intermediate CA SAN=nifi-registry.target.com).poc/poc.py:134-180poc/tls_rogue_server.py:27-56
Connects to the rogue TLS server from the attacker's machine, retrieves the certificate chain, and demonstrates that a Python port of the vulnerable Java verifier accepts the connection (bypass) while a fixed verifier rejects it.poc/poc.py:263-307poc/poc.py:415-451
Deploys and runs a Java test class inside the container that uses the actual vulnerable NiFiRegistryHostnameVerifier over a real TLS connection to the rogue server, confirming the bypass.poc/poc_vector2.py:81-231poc/poc_vector2.py:288-297
Tests the second vulnerable code path (NiFiHostnameVerifier) and verifies it is an identical code clone to the first.poc/poc_vector3.py:61-246

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection: Rogue TLS server on port 4443/4444 inside containerExpected behavior for demonstrating a TLS hostname verification bypass MITM scenario.poc/poc.py:50poc/poc_vector2.py:30
Certificate Generation: Crafted certificate chain with target hostname in intermediate CA SANNecessary to demonstrate the vulnerability where the verifier checks all certificates in the chain.poc/poc.py:13-16poc/tls_rogue_server.py:5-8
Docker Exec: Commands executed inside container via docker execUsed to set up the lab environment, start the rogue server, and run Java verification tests. All commands are directly related to demonstrating the CVE.poc/poc.py:105-108poc/poc_vector2.py:66-69

Review boundaries

What the analysis did not establish

Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 16 unclassified files (73,897 bytes) and 1 non-text media file (16,270 bytes) are present but not analyzed.
The analysis treats the supplied PoC code as untrusted data and does not execute it; classification is based solely on static review of the provided text.
The artifact relies on a Docker lab environment and pre-built Java classes; the analysis cannot verify that the exploit functions as described without executing the code.
Binary files (1 non-text media file, 16 unclassified files) were not analyzed; their metadata was flagged but content was not inspected.
The review is limited to the supplied text evidence and does not verify the safety of the Docker images, Maven dependencies, or pre-compiled Java classes referenced in the lab setup.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2025-59060/docker-compose.yml

Created 2026-05-19Vuln labCVE-2025-59060Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2025-59060/docker-compose.yml

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Environment assessment

A Docker Compose lab for CVE-2025-59060, an Apache Ranger TLS hostname verification bypass. It builds a container with the vulnerable Apache Ranger 2.7.0 source, pre-compiled standalone Java verifier classes, and certificate generation scripts. The lab is designed to demonstrate the vulnerability through multiple PoC scripts.

CVE-2025-59060/docker-compose.yml:1-29CVE-2025-59060/Dockerfile.vulnerable:1-101CVE-2025-59060/README.md:1-291

Lab assessment

Vulnerability lab

The environment is explicitly described as a Docker lab for CVE-2025-59060. It includes a vulnerable Apache Ranger build, standalone vulnerable/fixed verifier classes, certificate generation scripts, and multiple PoC scripts that demonstrate the hostname verification bypass. The README and verification report confirm the vulnerability-research purpose.

CVE-2025-59060/docker-compose.yml:1-3CVE-2025-59060/README.md:1-4CVE-2025-59060/poc_verification_report.md:1-5

Lab shapeCompose · builds

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable service

vulnerable target environmentbuild and test container

A single service built from Dockerfile.vulnerable. It clones Apache Ranger 2.7.0, builds the vulnerable NiFi plugin modules, compiles standalone vulnerable/fixed hostname verifier Java classes, and includes a certificate generation script. It runs a simple HTTP server on port 8080 (mapped to host port 20880) and keeps the container alive with 'tail -f /dev/null'.

CVE-2025-59060/docker-compose.yml:10-24CVE-2025-59060/Dockerfile.vulnerable:1-101

VulnerableHostnameVerifier.java

vulnerable code samplestandalone test class

A standalone Java class extracted from Apache Ranger 2.7.0's NiFiRegistryClient.java. It implements a HostnameVerifier that iterates over all certificates in the peer chain and returns true if any SAN matches the hostname, demonstrating the vulnerability.

CVE-2025-59060/standalone/VulnerableHostnameVerifier.java:1-66

FixedHostnameVerifier.java

fixed code samplestandalone test class

A standalone Java class representing the fixed verifier from Apache Ranger 2.8.0. It only checks the leaf certificate (certificates[0]) for hostname matching, as per the TLS specification.

CVE-2025-59060/standalone/FixedHostnameVerifier.java:1-64

HostnameVerifierTest.java

standalone Java test harness

A Java test class that loads or generates a crafted certificate chain, creates a mock SSLSession, and tests both the vulnerable and fixed verifiers. It outputs a summary confirming the vulnerability when the vulnerable verifier accepts and the fixed verifier rejects.

CVE-2025-59060/standalone/HostnameVerifierTest.java:1-317

generate_certs.sh

certificate generation script

A bash script that generates a TLS certificate chain exploiting the vulnerability: a leaf cert with SAN=attacker.com, an intermediate CA cert with SAN=nifi-registry.target.com, and a root CA. It also creates PKCS12 keystores and displays the attack scenario.

CVE-2025-59060/scripts/generate_certs.sh:1-117

poc.py

PoC script (Vector 1)

A Python script that starts a rogue TLS server inside the container, connects remotely over the Docker network, retrieves the certificate chain, and demonstrates the hostname verification bypass using a Python port of the vulnerable Java logic. It also runs the actual Java verifier for confirmation.

CVE-2025-59060/poc/poc.py:1-521

poc_vector2.py

PoC script (Vector 2)

A Python script that deploys a Java test class inside the container, starts a rogue TLS server, and has the Java client connect over a real TLS socket using the actual VulnerableHostnameVerifier. It confirms the bypass over a live TLS connection.

CVE-2025-59060/poc/poc_vector2.py:1-388

poc_vector3.py

PoC script (Vector 3)

A Python script that tests the second affected code path (NiFiHostnameVerifier from plugin-nifi). It verifies that both verifier classes are identical code clones and that the NiFi plugin is also vulnerable.

CVE-2025-59060/poc/poc_vector3.py:1-277

tls_rogue_server.py

rogue TLS server helper

A Python script that acts as a malicious TLS server, presenting the crafted certificate chain. It is intended to be launched by other PoC scripts and listens for connections, performing a TLS handshake and sending a success response.

CVE-2025-59060/poc/tls_rogue_server.py:1-117

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-59060

Supported by supplied evidence

The entire lab is built around CVE-2025-59060. The Dockerfile clones Apache Ranger 2.7.0, the vulnerable verifier code matches the described bug (iterating all certificates), the fixed verifier only checks the leaf, and all PoC scripts demonstrate the bypass. The README and verification report explicitly confirm the CVE.

CVE-2025-59060/standalone/VulnerableHostnameVerifier.java:30-42CVE-2025-59060/standalone/FixedHostnameVerifier.java:30-38CVE-2025-59060/README.md:1-4CVE-2025-59060/poc_verification_report.md:1-5

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker with Docker Compose pluginCVE-2025-59060/README.md:67-68
Approximately 2 GB disk space for Maven dependencies and JDK imageCVE-2025-59060/README.md:69
Build the Docker image: docker compose -p cve-2025-59060 buildCVE-2025-59060/README.md:73-74
Start the container: docker compose -p cve-2025-59060 up -dCVE-2025-59060/README.md:75

Evidence-described exercise path

Build and start the lab container using Docker Compose.CVE-2025-59060/README.md:73-75
Generate the crafted certificate chain inside the container.CVE-2025-59060/README.md:130-132
Run the standalone Java test to compare vulnerable and fixed verifiers.CVE-2025-59060/README.md:134-136
Alternatively, run the PoC scripts (poc.py, poc_vector2.py, poc_vector3.py) to demonstrate the vulnerability through different vectors.CVE-2025-59060/README.md:100-127

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the vulnerable verifier classes). The PoC scripts start a rogue TLS server inside the container and connect to it from the same container or over the Docker network, which is expected for demonstrating a TLS hostname verification bypass. There is no evidence of host escape, external connections, persistence, credential theft, data destruction, or backdoor behavior. The port mapping (20880:8080) is used for a simple HTTP server for lab verification, not for external compromise.

CVE-2025-59060/docker-compose.yml:20-24CVE-2025-59060/poc/poc.py:1-521CVE-2025-59060/poc/poc_vector2.py:1-388CVE-2025-59060/poc/poc_vector3.py:1-277

Review boundaries

What the analysis did not establish

The packet includes only text files; no binary analysis was performed.
The PoC scripts reference 'docker exec' and 'docker cp' commands that would require Docker access on the host, but these are part of the documented lab usage and not hidden behavior.
The compose file uses a host port mapping (20880:8080) which could expose the HTTP server to the host network, but this is documented for lab verification and not inherently malicious.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2025-59060