CVE-2018-19629

HIGH

hyland perceptive_content_server Improper Input Validation

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-19629 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a TCP connection.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 7, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

1
ProductSourceVersion range

perceptive_content_server

Browse hyland / perceptive_content_server
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubExcellencedev/CVE-2018-19629Repository PoCby Excellencedev0Scanner5 files

11.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a Docker-based test environment that emulates a vulnerable ImageNow Server service. The server.py script listens on TCP port 6000 and checks incoming data for a specific byte sequence (the 'TNMP' header). If the sequence is detected, the script logs a message and exits, simulating a crash. This behavior is designed to validate the presence of the vulnerability (CVE-2018-19629) by detecting the malicious payload, not to exploit a real target.

Backdoor review

No backdoor observed in reviewed code

The repository provides a Docker-based test environment for CVE-2018-19629, a denial-of-service vulnerability in Hyland Perceptive Content Server. The server.py script emulates the vulnerable service by listening on port 6000 and deliberately crashing (os._exit(1)) when it receives a specific byte sequence (the TNMP payload). This behavior is explicitly documented in the README and the code comments as a simulation of the CVE crash. No concealed backdoor, credential theft, persistence mechanism, or unrelated remote access was observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPythonDockerfile
Target softwareHyland Perceptive Content Server (ImageNow Server)
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a test harness that emulates a vulnerable service and checks for a specific malicious payload. It does not contain code to exploit a real, unmodified target; instead, it validates the vulnerability by detecting the payload and simulating a crash. This matches the definition of a scanner (code that checks for a vulnerability without exploiting it).

server.py:25-29README.md:2-4

Requirements

  • A running instance of the provided Docker container, which emulates the vulnerable service on TCP port 6000.README.md:23-24Dockerfile:10

Observed behavior

  • The server.py script listens on TCP port 6000 and accepts connections.server.py:8-9server.py:47-49
  • Upon receiving data, the script checks if it contains the hardcoded crash payload (hex: 544e4d5004000000544e4d4500000400).server.py:13-14server.py:25
  • If the payload is detected, the script prints a critical message and immediately terminates the process with os._exit(1), simulating a service crash.server.py:26-29
  • The README provides instructions for testing the environment with a Nuclei template and a manual Python script that sends the crash payload.README.md:33-35README.md:42-50
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Simulated Crash
Payload withheldThe server emulator intentionally exits to demonstrate the denial-of-service vulnerability described in CVE-2018-19629.server.py:25-29
Documented Payload
Payload withheldThe README and server.py both describe this as the crafted TCP packet that triggers the crash, matching the CVE description.README.md:47server.py:14
Review boundaries

What the analysis did not establish

  • The evidence includes only three text files (Dockerfile, README.md, server.py) out of five total files; two files are omitted and their content is unknown.
  • The server.py script is an emulator, not the actual vulnerable Hyland Perceptive Content Server binary, so the behavior is simulated rather than authentic.
  • Two files (docker-compose.yml and a nuclei template) were omitted from the text evidence; their content was not reviewed, but the README references them for standard Docker orchestration and vulnerability scanning, which is consistent with the stated purpose.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Excellencedev/CVE-2018-19629Created Vuln labCVE-2018-19629Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a Python TCP server emulating the ImageNow Server service on port 6000, designed to demonstrate a denial-of-service vulnerability (CVE-2018-19629).

docker-compose.yml:1-15Dockerfile:1-14server.py:1-62README.md:1-68

Lab assessment

Vulnerability lab

The README explicitly states it is a 'CVE-2018-19629 Test Environment' and provides instructions for triggering a denial-of-service crash. The server.py script contains a deliberate crash trigger matching the described payload, and the Docker Compose file exposes the service port for testing.

README.md:2-3server.py:12-13docker-compose.yml:7-8
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

imagenow-vulnerable

vulnerable service emulatorDoS target

A container built from python:3.9-slim running server.py, which listens on TCP port 6000 and intentionally exits when it receives a specific 16-byte payload, simulating the CVE-2018-19629 crash.

docker-compose.yml:4-5Dockerfile:2server.py:8-13server.py:25-29
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2018-19629

Supported by supplied evidence

The environment is explicitly labeled as a test environment for CVE-2018-19629, and the server.py script implements a crash trigger matching the described TNMP payload, consistent with a denial-of-service vulnerability in the ImageNow Server service.

README.md:2-3server.py:12-13server.py:25-29
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:24-25
  • The attacker must be able to send TCP packets to port 6000 on the host running the container.docker-compose.yml:7-8README.md:30-31

Evidence-described exercise path

  1. Start the vulnerable environment with 'docker-compose up -d'.README.md:24-25
  2. Verify the service is listening on port 6000, e.g., with 'nc -zv localhost 6000'.README.md:29-31
  3. Send the crafted 16-byte TNMP payload to the service using a provided Python script or a Nuclei template.README.md:35-37README.md:41-50
  4. Observe the container logs to confirm the crash message and container restart.README.md:52-55
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The server.py script only listens on the exposed port and exits upon receiving a specific payload; it does not perform any host escape, persistence, credential theft, data destruction, or external communication. The Docker Compose file uses a standard port mapping and does not enable privileged mode or mount sensitive host paths.

server.py:1-62docker-compose.yml:1-15Dockerfile:1-14
Review boundaries

What the analysis did not establish

  • The .gitignore file is not included in the evidence, but its absence does not affect the analysis of the provided artifacts.
  • The Nuclei template referenced in the README is not included in the packet, so its behavior cannot be assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2