CVE-2018-15599

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-15599 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubRemnant-DB/CVE-2018-15599Repository PoCby Remnant-DB0Not analyzed4 files

3.6 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

compose.yaml

Remnant-DB/CVE-2018-15599Created Vuln labCVE-2018-15599Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose lab that builds and runs a Debian-based container with a vulnerable Dropbear SSH server (version 2018.76) for local security testing.

compose.yaml:1-12Dockerfile:1-33

Lab assessment

Vulnerability lab

The README explicitly states the lab is for 'defensive analysis and hardening validation for ssh-adv-14-dropbear-enum-cve-2018-15599', the Dockerfile builds a specific vulnerable Dropbear version, and the entrypoint script prints a lab objective banner.

README.md:1-3entrypoint.sh:3-5Dockerfile:3
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

target

vulnerable SSH serverlab target

A container built from debian:bookworm-slim, running Dropbear SSH 2018.76 on port 22 (mapped to host 2222). It creates two users (field and vault), stores a flag file, and starts Dropbear via entrypoint.sh.

compose.yaml:2-12Dockerfile:1-33entrypoint.sh:1-14
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2018-15599

Supported by supplied evidence

The Dockerfile builds Dropbear version 2018.76, which is the version associated with CVE-2018-15599 (user enumeration vulnerability). The README and entrypoint banner explicitly reference this CVE.

Dockerfile:3README.md:1entrypoint.sh:4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker or Podman with Compose support installed.README.md:15-24
  • Network access to download Debian packages and the Dropbear source tarball during build.Dockerfile:5-7Dockerfile:17

Evidence-described exercise path

  1. Build and start the lab container using Docker Compose or Podman Compose.README.md:47-55
  2. Verify the SSH service is listening on host port 2222.README.md:67-71
  3. Perform user enumeration against the Dropbear server to exploit CVE-2018-15599.README.md:1-3entrypoint.sh:4
  4. Optionally, retrieve the flag from /home/vault/flag.txt after gaining access.Dockerfile:13-15
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab container: building a vulnerable Dropbear server, creating test users, and starting SSH. No host escape, external connections, persistence, or destructive actions are present. The port mapping (2222:22) is a documented lab requirement.

compose.yaml:1-12Dockerfile:1-33entrypoint.sh:1-14README.md:1-103
Review boundaries

What the analysis did not establish

  • No exploit code or proof-of-concept is included; the exercise path for user enumeration is implied but not detailed.
  • The Dockerfile downloads a tarball from an external source (matt.ucc.asn.au) during build, which is a supply chain consideration but not inherently malicious.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

6