CVE-2019-18276 has a selected CVSS score of 7.8 (high); EIP currently links 2 repository PoCs and 2 lab environments.
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
A single Dockerfile builds a Debian 10 container with two users, batman (victim) and joker (attacker). It installs gcc, sets /bin/bash as SUID owned by batman, and copies an exploit script for joker. The README states it is a study and proof-of-concept for CVE-2019-18276.
gotham/Dockerfile:1-57README.txt:1-7The README explicitly states the directory contains a Dockerfile and exploit script for studying and demonstrating CVE-2019-18276. The Dockerfile creates a vulnerable SUID bash setup and provides an attacker user with a compiled exploit script.
README.txt:1-7gotham/Dockerfile:1-57Builds a Debian 10 image, installs gcc, creates user batman with SUID /bin/bash, creates user joker, and copies exploit.sh to joker's home directory. It also creates a secret file for batman.
gotham/Dockerfile:1-57A bash script that prompts for batman's UID, generates a C shared library with a constructor that calls setuid() to that UID, compiles it, and instructs the user to load it via 'enable -f' in bash to drop privileges.
gotham/exploit.sh:1-52A non-privileged user who owns /bin/bash with SUID bit set, and has a secret file. The exploit targets this user's privileges.
gotham/Dockerfile:10-22A non-privileged user who starts the container session and has access to the exploit script.
gotham/Dockerfile:25-57Supported by supplied evidence
The exploit.sh script header explicitly references CVE-2019-18276 and describes a Bash 5.0 SUID privilege drop exploit. The Dockerfile sets up a SUID bash owned by a non-root user, which matches the known vulnerability in Bash's handling of effective vs. real UID when loading functions.
gotham/exploit.sh:1-8gotham/Dockerfile:20-22README.txt:3-5gotham/Dockerfile:1-57gotham/exploit.sh:18-20gotham/Dockerfile:1-57gotham/Dockerfile:55-57gotham/exploit.sh:1-52gotham/exploit.sh:18-20gotham/exploit.sh:48-52All visible behavior is confined to the container's intended vulnerability lab: building a vulnerable SUID bash, creating test users, and running an exploit script that only manipulates privileges within the container. No host escape, external connections, persistence, credential theft, or destructive actions are observed.
gotham/Dockerfile:1-57gotham/exploit.sh:1-52This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A single Docker container based on Debian 10 that creates two users ('victime' and 'hacker'), sets up a SUID bash owned by 'victime', and provides scripts to demonstrate privilege escalation via CVE-2019-18276 (bash enable -f).
demonstration/Dockerfile:1-19demonstration/init_utilisateurs.sh:1-51demonstration/exploit.sh:1-62The environment explicitly references CVE-2019-18276, creates a vulnerable SUID bash configuration, and includes an exploit script that compiles and loads a shared object to escalate privileges, consistent with a vulnerability reproduction lab.
demonstration/exploit.sh:20-22README:1Defines a Debian 10 image, installs gcc and openssh-server, copies three scripts, and sets the default command to init_utilisateurs.sh.
demonstration/Dockerfile:1-19Creates users 'victime' and 'hacker' with known passwords, sets /bin/bash as SUID owned by victime, moves creation_secret.sh to victime's home and exploit.sh to hacker's home, then switches to user victime.
demonstration/init_utilisateurs.sh:1-51Creates a secret file readable only by 'victime' in /home/victime, then switches to user 'hacker'.
demonstration/creation_secret.sh:1-15Prompts for the effective UID of 'victime', generates a C shared library that calls setuid() to that UID, compiles it, and instructs the user to load it via 'enable -f' to read the secret file.
demonstration/exploit.sh:1-62Builds the Docker image tagged 'demonstration' and runs it interactively with --rm.
demonstration/make.sh:1-4Supported by supplied evidence
The exploit script explicitly references CVE-2019-18276 and demonstrates loading a shared object via bash's 'enable -f' to escalate privileges, which matches the known vulnerability in bash's handling of the enable builtin.
demonstration/exploit.sh:20-22demonstration/exploit.sh:55-58demonstration/make.sh:3-4demonstration/exploit.sh:25-27README:10demonstration/make.sh:3demonstration/make.sh:4README:7-9README:10-12README:13All visible behavior is confined to the container and directly supports the CVE-2019-18276 demonstration. The container runs with --rm, no host mounts or privileged mode are specified, and no network connections or persistence outside the container are indicated.
demonstration/make.sh:4demonstration/Dockerfile:1-19This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.