aeyesec/CVE-2022-34265

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2022-34265Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds a Django 4.0.5 application with a PostgreSQL database, exposing two web endpoints designed to demonstrate SQL injection via the Trunc and Extract database functions.

docker-compose.yml:1-30Dockerfile:1-18README.md:1-143

Lab assessment

Vulnerability lab

The README explicitly describes a proof-of-concept verification for CVE-2022-34265, a Django SQL injection vulnerability. The provided source code (views.py) implements vulnerable endpoints that pass user-supplied parameters directly to the Trunc and Extract functions, and the README includes example curl commands to trigger the vulnerability.

README.md:1-143views.py:1-26
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

v4_0_5

Django web applicationvulnerable target

A Django 4.0.5 application built from the local Dockerfile. It runs migrations and starts the development server on port 8000. It exposes two endpoints (/extract/ and /trunc/) that pass user-supplied GET parameters directly to the Extract and Trunc database functions, enabling SQL injection.

docker-compose.yml:5-12Dockerfile:1-18views.py:1-26urls.py:20-22

postgres

database server

A PostgreSQL database service using the latest postgres image. It is configured with a database named 'vuln', user 'vuln', and password 'vuln', listening on port 5433. It includes a health check using pg_isready.

docker-compose.yml:14-28
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-34265

Supported by supplied evidence

The README explicitly states the environment is for verifying CVE-2022-34265. The provided views.py passes user-supplied parameters directly to the Extract and Trunc functions without sanitization, matching the vulnerability description. The Dockerfile installs Django 4.0.5, which is within the affected version range (Django 4.0.x prior to 4.0.6).

README.md:1-143views.py:8-25Dockerfile:5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:5-8
  • The v4_0_5 service depends on the postgres service being healthy before starting.docker-compose.yml:9-11

Evidence-described exercise path

  1. Build and start the environment using 'docker-compose build' and 'docker-compose up -d'.README.md:5-8
  2. Send a normal request to the /extract/ endpoint with lookup_name=year to observe baseline behavior.README.md:107-108
  3. Send a malicious request to the /extract/ endpoint with a crafted lookup_name parameter containing SQL injection payload to trigger PG_SLEEP and observe a delay.README.md:111
  4. Send a normal request to the /trunc/ endpoint with kind=year to observe baseline behavior.README.md:108
  5. Send a malicious request to the /trunc/ endpoint with a crafted kind parameter containing SQL injection payload to trigger PG_SLEEP and observe a delay.README.md:112
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target (the Django application and its database). The port mapping (4131:8000) is a standard lab requirement for accessing the web service. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended vulnerability demonstration is present.

docker-compose.yml:1-30Dockerfile:1-18views.py:1-26README.md:1-143
Review boundaries

What the analysis did not establish

  • The packet includes only one CVE (CVE-2022-34265) in unit_cve_ids, but the README also references CVE-2020-7471. That CVE is not assessed because it is not in the unit_cve_ids array.
  • The Docker Compose file uses version '2.1' which is deprecated; no schema validation was performed.
  • The postgres service uses the 'latest' tag, which may introduce variability in reproduction.
  • The README mentions a 'ThinkPad Ubuntu20.04' verification environment, but the packet does not include that host configuration.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1