CVE-2016-5180

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2016-5180 has a selected CVSS score of 9.8 (critical); EIP currently links 3 repository PoCs and 1 lab environment.

Description

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3
Lab environments
1

Proofs of concept

3

Repository PoCs

GitHubpouriam23/CVE-2016-5180Repository PoCby pouriam230Not analyzed3 files

37.1 KiB

GitHub
PoC details
GitHubpouriam23/CVE-2016-5180-docker-Repository PoCby pouriam230Not analyzed3 files

1.5 KiB

GitHub
PoC details
GitHubpouriam23/final-CVE-2016-5180Repository PoCby pouriam230Not analyzed4 files

2.6 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

pouriam23/CVE-2016-5180-docker-Created Vuln labCVE-2016-5180Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-container Node.js web application that accepts a hostname via a form and performs a DNS resolution, described as a CTF challenge vulnerable to CVE-2016-5180.

Dockerfile:1-17package.json:1-13server.js:1-34

Lab assessment

Vulnerability lab

The package.json description explicitly states 'CTF vulnerable to CVE-2016-5180 (Node.js + c-ares)' and the server.js code passes user-supplied hostname directly to dns.resolve, which is the attack vector for CVE-2016-5180.

package.json:4server.js:21-22
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

node:0-slim base image

base operating system and Node.js runtime

Provides the Node.js 0.x runtime environment on a slim Debian base, which includes the vulnerable c-ares library.

Dockerfile:1

CTF web application (server.js)

vulnerable targetweb serverDNS resolver

An Express.js application serving a form at GET / and a POST /register endpoint that takes a 'callback' hostname and resolves it using dns.resolve without sanitization, enabling the CVE-2016-5180 vulnerability.

server.js:1-34
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2016-5180

Supported by supplied evidence

The environment uses Node.js 0.x (node:0-slim) which bundles a vulnerable c-ares version, and the application passes unsanitized user input to dns.resolve, matching the known attack vector for CVE-2016-5180 (a buffer overflow in c-ares).

Dockerfile:1server.js:21-22
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.Dockerfile:1-17
  • The container must be built and run, exposing port 3000.Dockerfile:14
  • An attacker must be able to send HTTP POST requests to the /register endpoint with a crafted hostname.server.js:18-22

Evidence-described exercise path

  1. Build the Docker image from the provided Dockerfile.Dockerfile:1-17
  2. Run the container, ensuring port 3000 is accessible.Dockerfile:14
  3. Send a POST request to /register with a crafted 'callback' hostname designed to trigger the buffer overflow in c-ares via dns.resolve.server.js:21-22
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The visible code only starts a web server on port 3000 and performs DNS resolution on user input. There is no evidence of host escape, external connectivity beyond DNS, persistence, credential theft, or destructive behavior. The behavior is entirely contained within the lab's intended vulnerability demonstration.

server.js:1-34Dockerfile:1-17
Review boundaries

What the analysis did not establish

  • No docker-compose.yml or runtime configuration is provided; port mapping and network mode are unspecified.
  • The exact exploit payload and its effect (e.g., crash vs. code execution) are not included in the evidence.
  • The base image 'node:0-slim' is outdated and may have other vulnerabilities, but only CVE-2016-5180 is assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

10