GitHub Exploit Metadata - Exploit Intel

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

The artifact contains Python scripts that send crafted PROXY protocol v1 headers with malformed IP addresses to a target Exim MTA. The primary script (poc.py) sends a header with a leading '+' sign in the IPv4 source address, which bypasses Exim's hand-rolled IP validation but is rejected by the standard inet_pton() function, causing a child process crash (DoS). Additional scripts test leading zeros, malformed IPv6, and whitespace vectors. The code actively triggers the vulnerability to cause a denial-of-service condition.

Backdoor review

No backdoor observed in reviewed code

All reviewed PoC scripts and documentation target the claimed CVE-2023-42117 vulnerability in Exim. The Python scripts send crafted PROXY protocol headers to trigger a denial-of-service crash; they contain no concealed backdoor, persistence, credential theft, or unrelated payload. The code is straightforward, well-documented, and uses only standard library sockets.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareExim Mail Transfer Agent

Attack typesDenial of ServiceInput Validation Bypass

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is poc.py, which is explicitly designed to send a malicious PROXY header to a target, trigger a crash, and confirm the vulnerability. The code includes an 'exploit' function that sends the crafted payload and checks for a 421 response or connection reset, which are indicators of a successful denial-of-service attack. This is active exploitation of the vulnerability, not merely detection or scanning.

poc/poc.py:218-280poc/poc.py:121-178

Requirements

Exim must be compiled with SUPPORT_PROXY=yes and configured with hosts_proxy matching the attacker's source IP.README.md:23

Observed behavior

Sends a PROXY TCP4 header with a malformed source IP address containing leading '+' signs (e.g., '+0.+0.+0.+1') to the target Exim service.poc/poc.py:140-141
The malformed IP passes Exim's string_is_ip_address() validation but is later rejected by inet_pton(), causing a LOG_PANIC_DIE and a child process crash, resulting in a 421 error response.poc/poc.py:164-167
Additional scripts test other malformed IP vectors (leading zeros, malformed IPv6, whitespace) that also trigger the crash.poc/poc_vector2_leading_zeros.py:113-119poc/poc_vector3_ipv6.py:115-123poc/poc_vector4_whitespace.py:114-131

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection: TCP connection to user-supplied target_host:target_portAll PoC scripts connect to a user-specified target to send PROXY protocol headers. This is expected behavior for a vulnerability PoC.poc/poc.py:58-68poc/poc_vector2_leading_zeros.py:54-62poc/poc_vector3_ipv6.py:56-64poc/poc_vector4_whitespace.py:54-62
Command Execution: subprocess.run(['docker', 'exec', container_name, 'cat', '/var/log/exim/paniclog'])The primary PoC optionally reads the Exim panic log inside a Docker container to confirm crashes. This is a diagnostic check, not a backdoor.poc/poc.py:186-193

Review boundaries

What the analysis did not establish

The evidence includes a verification report (poc_verification_report.md) with test results, but the analysis is based solely on the supplied source code and documentation; the code was not executed.
The artifact is part of a larger repository; only the files in the CVE-2023-42117 directory were provided. The Dockerfile and configuration files referenced in the README are not included in the text evidence.
Six unclassified files (Dockerfile, docker-compose.yml, exim.conf, and three binary/other files) were not analyzed; their metadata was flagged but content was not inspected. The review covers only the seven selected text files.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2023-42117/docker-compose.yml

Created 2026-05-19Vuln labCVE-2023-42117Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Environment assessment

A single-container Docker Compose lab that builds and runs a vulnerable Exim 4.96 MTA with PROXY protocol support enabled, intended for testing CVE-2023-42117.

CVE-2023-42117/docker-compose.yml:1-28CVE-2023-42117/Dockerfile.vulnerable:1-73CVE-2023-42117/README.md:1-312

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for CVE-2023-42117, provides a vulnerable Exim build, and includes PoC scripts to trigger the vulnerability. The Dockerfile builds a known vulnerable version (Exim 4.96) with the required SUPPORT_PROXY=yes option, and the configuration enables the PROXY protocol from all hosts.

CVE-2023-42117/README.md:1-3CVE-2023-42117/README.md:7-9CVE-2023-42117/Dockerfile.vulnerable:1-3CVE-2023-42117/Dockerfile.vulnerable:30-31

Lab shapeCompose · builds

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable

vulnerable Exim MTA target

A Debian bookworm-slim container running Exim 4.96 compiled with SUPPORT_PROXY=yes. It listens on port 25 (mapped to host port 2525) and accepts PROXY protocol connections from any host. The configuration uses a minimal ACL that accepts all recipients and delivers mail to /dev/null. A healthcheck monitors the Exim daemon process.

CVE-2023-42117/docker-compose.yml:8-22CVE-2023-42117/Dockerfile.vulnerable:1-73CVE-2023-42117/exim.conf:1-30

poc.py

primary exploit script

A Python 3 script that sends a PROXY TCP4 header with a malformed source IP (+0.+0.+0.+1) to trigger the string_is_ip_address() validation bypass and cause a child process crash. It includes a control test with a valid header and checks the Exim panic log for crash evidence.

CVE-2023-42117/poc/poc.py:1-280

poc_vector2_leading_zeros.py

exploit variant script

A Python 3 script that tests IPv4 addresses with leading zeros (e.g., 01.02.03.04) to exploit the same validation bypass.

CVE-2023-42117/poc/poc_vector2_leading_zeros.py:1-143

poc_vector3_ipv6.py

exploit variant script

A Python 3 script that tests malformed IPv6 addresses (5-digit hex components, mask suffixes, interface IDs) via PROXY TCP6 headers.

CVE-2023-42117/poc/poc_vector3_ipv6.py:1-147

poc_vector4_whitespace.py

exploit variant script

A Python 3 script that tests whitespace and edge cases, such as tab-prefixed IPv4 addresses and plus-sign variants on source/destination IPs.

CVE-2023-42117/poc/poc_vector4_whitespace.py:1-160

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-42117

Supported by supplied evidence

The lab explicitly targets CVE-2023-42117. The Dockerfile builds the affected version (Exim 4.96) with SUPPORT_PROXY=yes, the configuration enables hosts_proxy=*, and the PoC scripts demonstrate the described validation bypass and child process crash. The README and verification report detail the vulnerability and confirm successful exploitation.

CVE-2023-42117/README.md:1-3CVE-2023-42117/README.md:7-9CVE-2023-42117/Dockerfile.vulnerable:1-3CVE-2023-42117/Dockerfile.vulnerable:30-31CVE-2023-42117/exim.conf:8CVE-2023-42117/poc_verification_report.md:1-5

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Exim must be compiled with SUPPORT_PROXY=yes (enabled in Dockerfile).CVE-2023-42117/Dockerfile.vulnerable:30-31
Exim must be configured with hosts_proxy matching the attacker's source IP (set to * in exim.conf).CVE-2023-42117/exim.conf:8
The attacker must be able to reach the Exim service on the mapped port (2525 on the host).CVE-2023-42117/docker-compose.yml:13-14

Evidence-described exercise path

Build and start the vulnerable container using 'docker compose build && docker compose up -d'.CVE-2023-42117/README.md:7-9
Run the primary PoC script: 'python3 poc/poc.py localhost 2525'.CVE-2023-42117/README.md:7-9
Observe the 421 response indicating a child process crash, and verify crash evidence in the Exim panic log.CVE-2023-42117/README.md:7-9CVE-2023-42117/README.md:11-12
Optionally run the other PoC variants (vector2, vector3, vector4) to test different malformed IP inputs.CVE-2023-42117/README.md:7-9CVE-2023-42117/README.md:14-16
Stop the lab with 'docker compose down'.CVE-2023-42117/README.md:7-9

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable Exim container. The PoC scripts send crafted PROXY headers to the container's SMTP port to trigger a crash, which is the expected demonstration of the vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, data destruction, or backdoor behavior. The container runs without privileged mode, and the port mapping (2525:25) is a standard lab requirement.

CVE-2023-42117/docker-compose.yml:1-28CVE-2023-42117/poc/poc.py:1-280CVE-2023-42117/poc/poc_vector2_leading_zeros.py:1-143CVE-2023-42117/poc/poc_vector3_ipv6.py:1-147CVE-2023-42117/poc/poc_vector4_whitespace.py:1-160

Review boundaries

What the analysis did not establish

The PoC scripts contain a default target IP (172.19.0.9) that may not match the actual container IP; this is a convenience default and not inherently malicious.
The verification report and README describe an RCE path that is not demonstrated by the supplied PoC scripts; the visible behavior is limited to DoS.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.