cberman/CVE-2023-2822-demo

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2023-2822Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A simple Flask web application containerized with Docker, intended as an intentionally vulnerable demo for CVE-2023-2822 (reflected XSS).

README.md:1-3Dockerfile:1-8

Lab assessment

Vulnerability lab

The README explicitly states the application is an 'intentionally vulnerable web app to demo CVE-2023-2822' and provides build/run instructions for a Docker container.

README.md:1-3
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Flask application (app.py)

web servervulnerable target

A Python Flask app with a /logout endpoint that takes a 'url' parameter, applies a weak blocklist for 'script' and 'onload', and renders the parameter unsafely in logout.html using the 'safe' filter, enabling reflected XSS.

app.py:1-17templates/logout.html:1-12

Dockerfile

containerizationenvironment setup

Builds a container from python:3.9-slim-buster, installs Flask, copies the application code, and runs app.py on port 5000.

Dockerfile:1-8

HTML templates

user interfaceXSS sink

home.html provides a link to /logout; 403.html shows a blocked message; logout.html renders the 'url' parameter with the 'safe' filter, creating the XSS sink.

templates/home.html:1-12templates/403.html:1-12templates/logout.html:1-12

Static CSS

styling

Provides basic styling for the web pages.

static/style.css:1-23
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-2822

Supported by supplied evidence

The README explicitly states the app is a demo for CVE-2023-2822, and the code contains a reflected XSS vulnerability in the /logout endpoint, consistent with the CVE description.

README.md:1-3app.py:9-13templates/logout.html:9
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:6-8
  • The attacker must be able to send HTTP requests to the /logout endpoint with a crafted 'url' parameter.app.py:9-13

Evidence-described exercise path

  1. Build the Docker image using 'docker build -t xss-demo .'README.md:6-7
  2. Run the container with 'docker run -p <host_port>:5000 xss-demo'README.md:8
  3. Craft a request to /logout?url= with a payload that bypasses the blocklist (e.g., using event handlers other than 'onload' or 'script') to trigger reflected XSS.app.py:9-13templates/logout.html:9
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The application is a self-contained Flask app that listens on port 5000 inside a container. It does not attempt to escape the container, access host resources, connect to external systems, or perform any destructive actions. The XSS vulnerability is the intended lab target.

app.py:1-17Dockerfile:1-8
Review boundaries

What the analysis did not establish

  • No docker-compose or orchestration files are present; the lab is a single Dockerfile.
  • The packet does not include any exploit payloads or proof-of-concept scripts.
  • The CVE association relies solely on the README claim; no external CVE details are provided in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1