Cacti application
vulnerable target
Cacti 1.2.26 is downloaded, extracted, and configured with database credentials. It is the intended target for the CVE-2025-22604 RCE exercise.
Dockerfile:1-182ishwardeepp/CVE-2025-22604-Cacti-RCE
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Docker lab environments
1GitHubRepository root
Created Vuln labCVE-2025-22604Dockerfile
Analysis
Environment assessment
A single Dockerfile based on Ubuntu 18.04 that installs MySQL, Apache2, PHP, and Cacti 1.2.26, then configures them via startup scripts to create a self-contained Cacti monitoring application environment.
Dockerfile:1-182Lab assessment
Vulnerability labThe repository name and README explicitly reference CVE-2025-22604, a Cacti RCE vulnerability. The Dockerfile builds a specific vulnerable version of Cacti (1.2.26) and configures it, consistent with a vulnerability reproduction environment.
README.md:1Dockerfile:1-182Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
MySQL database
database backend for Cacti
MySQL is installed, started, and configured with a database and user for Cacti. The root password and Cacti user credentials are set via environment variables.
Dockerfile:1-182Apache2 web server
web server for Cacti
Apache2 with PHP is installed and configured to serve Cacti. It listens on port 80.
Dockerfile:1-182Startup scripts
automated configuration and service startup
A set of shell scripts (startup.sh, startup_mysql.sh, startup_apache2.sh, startup_cacti.sh) and a PHP helper (sed.php) are created to configure services and start them when the container runs.
Dockerfile:1-182How the supplied evidence relates each vulnerability
CVE-2025-22604
Insufficient evidence
The Dockerfile builds Cacti 1.2.26, which is the version associated with CVE-2025-22604, but no exploit code, proof-of-concept, or vulnerability description is included. The README only states the CVE ID. Without additional evidence, the association cannot be confirmed or denied.
README.md:1Dockerfile:1-182Requirements and sequence described by the evidence
Prerequisites
- Docker must be installed to build and run the container.
Dockerfile:1-182 - The container must be built from the Dockerfile.
Dockerfile:1-182 - Port 80 must be exposed and accessible to interact with the Cacti web interface.
Dockerfile:1-182
Evidence-described exercise path
- Build the Docker image from the provided Dockerfile.
Dockerfile:1-182 - Run a container from the built image, ensuring port 80 is mapped to the host.
Dockerfile:1-182 - Access the Cacti web interface at http://<host-ip>/cacti to verify the application is running.
Dockerfile:1-182 - Exploit CVE-2025-22604 against the Cacti instance (exploit not provided in the packet).
README.md:1
Behaviors behind the stored safety assessment
No harmful behavior observed
The Dockerfile only installs and configures standard services (MySQL, Apache, Cacti) within the container. No hidden, destructive, or externally connecting behavior is visible. The exposed port 80 is typical for a web application lab.
Dockerfile:1-182What the analysis did not establish
- No exploit code or proof-of-concept is included; the exercise path beyond setup is unspecified.
- The Dockerfile uses hardcoded credentials (e.g., rootpassword) which is insecure but not malicious in a lab context.
- The base image ubuntu:18.04 is end-of-life and may contain unpatched vulnerabilities, but this is not directly visible in the packet.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.