RUB-NDS/CVE-2020-2655-DemoServer

GitHubRepository PoC

PoC files

20 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2020-2655Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a Java server from a pre-built JAR and a Java KeyStore, exposing ports 4433 and 4434/udp. The repository name and README associate it with CVE-2020-2655, suggesting a demonstration or proof-of-concept server for that vulnerability.

Dockerfile:1-7README.md:1

Lab assessment

Vulnerability lab

The repository is named 'CVE-2020-2655-DemoServer', the README states '# CVE-2020-2655-DemoServer', and the Dockerfile builds a 'cve-2020-2655poc' stage. The artifact ID in pom.xml is 'CVE-2020-2655-PoC-Server'. These explicit references to a CVE and 'Demo'/'PoC' indicate a vulnerability research or demonstration environment.

README.md:1Dockerfile:1pom.xml:5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

openjdk base image

Java runtime

Provides the Java runtime environment for the PoC server. The image is pinned by digest.

Dockerfile:1

PoC-Server.jar

Vulnerability demonstration server

A pre-built executable JAR that is the entrypoint of the container. It is a binary file and its behavior is uninspected. The pom.xml indicates the main class is de.rub.nds.tls.server.Main.

Dockerfile:2Dockerfile:6pom.xml:33

server.jks

TLS key material

A Java KeyStore file added to the container root. It is a binary file and its contents are uninspected. Likely provides the server certificate and private key for the TLS/DTLS server.

Dockerfile:3

target/ directory contents

Compiled classes and metadata

The entire target/ directory from the build context is copied into the container. It includes compiled .class files (e.g., DtlsServer.class, Main.class) and Maven metadata. The classes implement a DTLS server and a main entry point.

Dockerfile:2target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst:1-4
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-2655

Insufficient evidence

The packet associates the environment with CVE-2020-2655 through repository name, README, Dockerfile stage name, and artifact ID. However, no CVE description, vulnerable library version, or exploit code is visible in the supplied text. The server JAR and key store are binary and uninspected. The evidence is limited to naming conventions, which is insufficient to confirm or refute the CVE association.

README.md:1Dockerfile:1pom.xml:5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image from the Dockerfile.Dockerfile:1-7
  • The pre-built target/PoC-Server.jar and server.jks must be present in the build context.Dockerfile:2-3
  • A client capable of connecting to the exposed ports (4433/TCP, 4434/UDP) is needed to interact with the server.Dockerfile:4-5

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-7
  2. Run a container from the image, ensuring ports 4433 and 4434/udp are published.Dockerfile:4-5
  3. Connect a client to the server on the exposed ports to trigger or observe the vulnerability behavior.Dockerfile:4-5
Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The Dockerfile only builds a container, copies local files, exposes ports, and runs a Java JAR. No commands download external resources, modify the host, or establish persistence. However, the JAR and key store are binary and uninspected; their runtime behavior is unknown. Without inspecting the binaries, it is impossible to determine whether the server performs any harmful actions beyond the intended lab target.

Dockerfile:1-7
Review boundaries

What the analysis did not establish

  • The packet contains 6 binary files (PoC-Server.jar, server.jks, and compiled .class files) that are uninspected. Their runtime behavior cannot be assessed.
  • No CVE description, exploit code, or vulnerable dependency version is present in the text evidence. The CVE association relies solely on naming conventions.
  • The Dockerfile does not include a CMD or ENTRYPOINT that reveals arguments; the server's exact network behavior is unknown.
  • No client or test script is provided to demonstrate the exercise path.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 6 binary files not inspected

Linked vulnerabilities

1