CVE-2023-29509

GitHubCurated repository PoCCexploitintel/eip-pocs-and-cves

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

CVE-2023-29509/docker-compose.yml

Created Vuln labCVE-2023-29509Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a MySQL 8.0 database and an XWiki 13.10.10 web application, intended as a vulnerable lab for CVE-2023-29509.

CVE-2023-29509/docker-compose.yml:1-39

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for reproducing CVE-2023-29509, provides run instructions, and the Compose file uses a known vulnerable XWiki version (13.10.10).

CVE-2023-29509/README.md:1-69
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MySQL 8.0 service configured with a root password, a database 'xwiki', and a user 'xwiki' for the web application. Includes a healthcheck using mysqladmin.

CVE-2023-29509/docker-compose.yml:2-15

web

vulnerable target

XWiki 13.10.10 web application, the vulnerable version for CVE-2023-29509. Depends on the db service, exposes port 8080 to the host, and includes a healthcheck.

CVE-2023-29509/docker-compose.yml:17-33

poc.py

exploit script

Python script that authenticates to the XWiki target and sends a crafted URL to trigger the eval injection vulnerability, checking for a success marker in the response.

CVE-2023-29509/poc/poc.py:1-147
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-29509

Supported by supplied evidence

The README, PoC script, and verification report all describe an eval injection vulnerability in XWiki 13.10.10 matching CVE-2023-29509, and the lab uses that exact version.

CVE-2023-29509/README.md:1-69CVE-2023-29509/poc/poc.py:1-147CVE-2023-29509/poc_verification_report.md:1-43
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to start the lab.CVE-2023-29509/README.md:42-43
  • The XWiki distribution wizard must be completed via curl POST requests before the vulnerability can be exercised.CVE-2023-29509/README.md:45-50
  • An admin user must be created and logged in to save the vulnerable content to FlamingoThemesCode.WebHome.CVE-2023-29509/README.md:52-53
  • The PoC script requires Python 3 and network access to the target.CVE-2023-29509/poc/poc.py:1-147

Evidence-described exercise path

  1. Start the lab with 'docker compose up -d' and wait for XWiki to boot.CVE-2023-29509/README.md:42-44
  2. Complete the XWiki distribution wizard using four curl POST calls.CVE-2023-29509/README.md:45-50
  3. Login as admin and save the vulnerable content to FlamingoThemesCode.WebHome.CVE-2023-29509/README.md:52-53
  4. Run the PoC script with the target URL and credentials to trigger the exploit and confirm RCE.CVE-2023-29509/README.md:55-59
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The PoC targets only the lab's own XWiki container, and no evidence shows host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended exploit demonstration.

CVE-2023-29509/docker-compose.yml:1-39CVE-2023-29509/poc/poc.py:1-147
Review boundaries

What the analysis did not establish

  • The packet does not include the seed.sh script mentioned in the README, but the manual curl steps are provided.
  • The verification report references artifact files (poc_run.txt, cold_cycles.txt, etc.) that are not included in the evidence packet.
  • The intel_brief.md and vulnerability_analysis.md files are listed in the file inventory but not included as evidence, so their content is unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1