EQSTLab/CVE-2025-26788

GitHubRepository PoCStub

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains only a Dockerfile and a setup script for installing StrongKey FIDO Server v4.15.0. There is no exploit, scanner, or technical analysis code related to CVE-2025-26788.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Dockerfile and a setup script for StrongKey FIDO Server. The script downloads official v4.15.0 distribution archives from SourceForge, installs system packages, and deploys a sample application. No backdoor, concealed payload, or operator-directed harm is observed.

ClassificationStub
Model confidence95%
AuthenticationUnknown
LanguagesDockerfileShell
Target softwareStrongKey FIDO Server
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The repository contains only a Dockerfile and a shell script that installs the vulnerable software version. There is no code that exercises, detects, or analyzes the CVE-2025-26788 vulnerability. The artifact is a placeholder setup environment, not a PoC.

dockerfile:1-21setup-skfs.sh:1-73

Observed behavior

  • Builds a Rocky Linux 9.3 container with systemd.dockerfile:1-21
  • Downloads and installs StrongKey FIDO Server v4.15.0 and a sample application.setup-skfs.sh:1-73
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Download Source
https://sourceforge.net/projects/strongkeyfido/files/v4.15.0/server/fido2server-v4.15.0-dist.tgzThe setup script downloads the official StrongKey FIDO Server distribution from SourceForge.setup-skfs.sh:36
Download Source
https://sourceforge.net/projects/strongkeyfido/files/v4.15.0/sampleapps/java/basic/basicdemo.warThe setup script downloads a sample application WAR from the official StrongKey project on SourceForge.setup-skfs.sh:61
Review boundaries

What the analysis did not establish

  • Evidence is limited to two files: a Dockerfile and a setup script. No other files were provided, but the packet reports complete_artifact_coverage, indicating the repository contains only these files.
  • Only the two text files (Dockerfile and setup-skfs.sh) were reviewed. The downloaded archives (fido2server-v4.15.0-dist.tgz, basicdemo.war) are not included in the evidence and were not analyzed.
  • The review is limited to static analysis of the provided text; no dynamic execution or verification of the downloaded binaries was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2025-26788Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Rocky Linux 9.3 container with systemd, OpenLDAP, Java 21, and a StrongKey FIDO2 server (SKFS) v4.15.0 installed via a setup script. The script also deploys a basicdemo web application and configures a webauthntutorial properties file.

dockerfile:1-21setup-skfs.sh:1-73

Lab assessment

Vulnerability lab

The repository is named 'EQSTLab/CVE-2025-26788', explicitly associating the environment with a CVE identifier. The setup script installs a specific version of StrongKey FIDO2 server and deploys a sample application, which is consistent with a vulnerability reproduction or research environment.

dockerfile:1-21setup-skfs.sh:1-73
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Rocky Linux 9.3 base image

base operating system

Provides the OS foundation with systemd enabled. The Dockerfile installs systemd and related utilities, masks unnecessary services, and sets the init system as the entrypoint.

dockerfile:2-21

setup-skfs.sh

installerconfigurator

A bash script that installs dependencies (OpenLDAP, Java 21), downloads and extracts StrongKey FIDO2 server v4.15.0, patches the RPID, runs the installer, deploys basicdemo.war, and configures webauthntutorial properties. It uses a marker file to ensure idempotency.

setup-skfs.sh:1-73

StrongKey FIDO2 Server (SKFS) v4.15.0

FIDO2 servertarget application

The core application installed by the setup script. It is downloaded from SourceForge and installed via its bundled install-skfs.sh. The script patches the RPID to 'skfs.localdomain'.

setup-skfs.sh:30-48

basicdemo.war

sample web application

A Java web application deployed to the Payara server included with SKFS. It is downloaded from SourceForge and deployed using the asadmin tool.

setup-skfs.sh:50-54

webauthntutorial configuration

configuration file

A properties file created to set the API URI for the webauthntutorial application to 'https://skfs.localdomain:8181'.

setup-skfs.sh:56-60
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-26788

Insufficient evidence

The repository name and unit_cve_ids associate the environment with CVE-2025-26788, but the supplied evidence (Dockerfile and setup script) does not contain any vulnerability description, exploit code, or specific reference to the CVE's nature. The verdict cannot be determined from the visible files alone.

dockerfile:1-21setup-skfs.sh:1-73
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker host with cgroup volume support (implied by VOLUME /sys/fs/cgroup and systemd usage).dockerfile:18
  • Network access to download packages from Rocky Linux repositories and files from SourceForge.setup-skfs.sh:10setup-skfs.sh:33
  • The container must be run with sufficient privileges to run systemd (e.g., --privileged or appropriate capabilities).dockerfile:2

Evidence-described exercise path

  1. Build the Docker image from the provided Dockerfile.dockerfile:1-21
  2. Run the container with systemd privileges and execute the setup-skfs.sh script inside it to install and configure the StrongKey FIDO2 server.setup-skfs.sh:1-73
  3. Access the deployed basicdemo or webauthntutorial applications on the configured hostname and port to interact with the FIDO2 server.setup-skfs.sh:50-60
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and setup script only install software from official repositories and SourceForge, configure a local FIDO2 server, and deploy a sample application. There is no evidence of host escape, external connections beyond package downloads, persistence outside the container, credential theft, or destructive actions. The behavior is consistent with setting up a self-contained lab environment.

dockerfile:1-21setup-skfs.sh:1-73
Review boundaries

What the analysis did not establish

  • No exploit code or vulnerability description is included; the CVE association is based solely on the repository name.
  • The setup script downloads binaries (fido2server-v4.15.0-dist.tgz, basicdemo.war) from SourceForge; their contents are not inspected.
  • The Dockerfile does not specify a non-root user; the container runs as root by default, which is common for systemd-in-docker but increases risk if misused.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1