Dockerfile
base image declarationservice startupport exposure
Uses arafatansari/cveine:20207246 as base image, attempts to start apache2 and mysql services, and exposes port 80.
Dockerfile:1-4arafatansari/SecAssignment
PoC files
4 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Docker lab environments
1GitHubRepository root
Created Vuln labCVE-2020-7246Dockerfile
Analysis
Environment assessment
A single Dockerfile based on arafatansari/cveine:20207246, with a README describing a vulnerability lab for CVE-2020-7246 in qdPM 9.1, and an exploit script that performs path traversal and remote code execution.
Dockerfile:1-4README.md:1-25Lab assessment
Vulnerability labThe README explicitly states 'For educational purposes only' and provides steps to build, run, and exploit a qdPM instance vulnerable to CVE-2020-7246. The included exploit script targets the described vulnerability.
README.md:1-25Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
exploit.py
exploit script
Python script that logs into a qdPM instance, exploits a path traversal vulnerability to upload a backdoor PHP file, and reports the backdoor URL.
Exploit/exploit.py:1-92README.md
documentation
Provides build, run, exploit, and verification instructions for the CVE-2020-7246 lab.
README.md:1-25How the supplied evidence relates each vulnerability
CVE-2020-7246
Supported by supplied evidence
The README explicitly associates the lab with CVE-2020-7246, and the exploit script implements a path traversal and remote code execution attack consistent with the CVE description.
README.md:1Exploit/exploit.py:1-92Requirements and sequence described by the evidence
Prerequisites
- Docker must be installed to build and run the container.
README.md:8-12 - The target qdPM instance must be accessible at the provided URL.
README.md:16 - Valid user credentials (email and password) for the qdPM instance are required.
README.md:16
Evidence-described exercise path
- Clone the repository and build the Docker image.
README.md:8-10 - Run the container with port mapping and start services.
README.md:11-12 - Execute the exploit script against the target qdPM instance.
README.md:16 - Verify exploitation by accessing the uploaded backdoor.
README.md:20
Behaviors behind the stored safety assessment
No harmful behavior observed
The exploit script targets the lab's own qdPM instance and uploads a backdoor as part of the vulnerability demonstration. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior beyond the intended lab target.
Exploit/exploit.py:1-92README.md:1-25What the analysis did not establish
- The base image arafatansari/cveine:20207246 is not inspected; its contents and behavior are unknown.
- The Dockerfile uses RUN service apache2 start | service mysql start, which is not a valid way to start services in a container; the actual runtime behavior may differ.
- The exploit script is provided as-is; its exact behavior depends on the target environment and may have unintended effects if used outside the lab.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.