vigilante-1337/CVE-2024-11635

GitHubRepository PoC

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

safe-lab/docker_compose.yaml

Created Vuln labCVE-2024-11635Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a WordPress service with MariaDB, intended as a controlled lab for reproducing CVE-2024-11635.

safe-lab/docker_compose.yaml:1-42readme.md:1-107

Lab assessment

Vulnerability lab

The README explicitly states the environment is for reproducing CVE-2024-11635 in a controlled lab, and the Compose file sets up a WordPress instance with a vulnerable plugin.

readme.md:1-3readme.md:47-50
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mariadb

database

MariaDB database service for WordPress, configured with root password 'toor' and a WordPress database/user.

safe-lab/docker_compose.yaml:4-14

exploitdev

web servervulnerable target

WordPress service with PHP 8.4 on Apache, exposed on host port 80, intended to host the vulnerable WordPress File Upload plugin.

safe-lab/docker_compose.yaml:16-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-11635

Supported by supplied evidence

The README describes the vulnerability as unauthenticated RCE in WordPress File Upload <= 4.24.12 via 'wfu_ABSPATH' cookie, and the lab includes a vulnerable plugin ZIP (wp-file-upload.4.24.12.zip) for installation.

readme.md:17-19readme.md:47-50safe-lab/docker_compose.yaml:1-42
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab.readme.md:47-50
  • After deployment, an administrator must manually install and activate the vulnerable plugin from the safe-lab directory.readme.md:52-56

Evidence-described exercise path

  1. Clone the repository and navigate to the safe-lab directory.readme.md:40-42
  2. Start the lab with 'sudo docker compose up -d'.readme.md:47-50
  3. Complete WordPress setup and install/activate the vulnerable plugin from safe-lab/.readme.md:52-56
  4. Use the provided exploit binary (./exploit) against the lab target.readme.md:40-44
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file defines a standard WordPress+MariaDB stack with no privileged mode, no host volume mounts beyond named volumes, and no suspicious commands. The README explicitly warns to use the lab only in isolated environments. No behavior escaping the lab boundary is visible.

safe-lab/docker_compose.yaml:1-42readme.md:1-3readme.md:47-50
Review boundaries

What the analysis did not establish

  • The exploit binary (./exploit) is not included in the evidence packet and its behavior is uninspected.
  • The vulnerable plugin ZIP is present in the file inventory but its contents are not analyzed.
  • The lab requires manual plugin installation; the Compose file alone does not create a fully vulnerable environment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1