CVE-2022-30592

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-30592 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubefchatz/HTTP3-attacksRepository PoCby efchatz81Not analyzed5 files

9.3 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

http3-flood

efchatz/HTTP3-attacksCreated Vuln labCVE-2022-30592Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker environment that builds a custom curl client with HTTP/3 support using quiche and BoringSSL, intended to execute an HTTP/3 flooding script against a user-specified target server.

http3-flood/Dockerfile:1-49README.md:1-57

Lab assessment

Vulnerability lab

The README explicitly states the repository shares scripts for educational usage, tested against QUIC-enabled servers, and links to a research paper on HTTP/3 security. The Dockerfile builds a tool to execute an HTTP/3 flooding attack, which is a vulnerability research and testing activity.

README.md:1-5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds a custom curl HTTP/3 clientprepares the execution environment for the flood script

A multi-stage Dockerfile that fetches and builds quiche (a QUIC/HTTP3 library) and curl with HTTP/3 support, then creates a minimal executor image containing the custom curl binary, libraries, and the http3-flood.sh script.

http3-flood/Dockerfile:1-49

http3-flood.sh

executes the HTTP/3 flood attack

A bash script that runs an infinite loop, repeatedly spawning 10 parallel curl processes to send HTTP/3 requests with crafted headers and a binary data payload to a target URL, intended to stress or exploit the server.

http3-flood/http3-flood.sh:1-11
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-30592

Insufficient evidence

The README associates CVE-2022-30592 with the http-stream script, not the http3-flood script provided in this unit. The Dockerfile and http3-flood.sh do not contain any logic or payload specifically targeting the lsquic library vulnerability described in CVE-2022-30592. The relationship between the flood script and the CVE is not demonstrated.

README.md:5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:25
  • The operator must place the http3-flood.sh script in the same directory as the Dockerfile before building.README.md:26
  • The operator must edit the http3-flood.sh script to replace the placeholder URL with the target server's URL.README.md:27
  • The container must be run with --network host to allow direct network access to the target.README.md:29
  • The operator must use docker exec to access the container's bash shell and manually execute the flood script.README.md:32

Evidence-described exercise path

  1. Place the Dockerfile and http3-flood.sh script in the same directory.README.md:25-26
  2. Edit http3-flood.sh to set the target URL.README.md:27
  3. Build the Docker image with 'docker build -t curl-http3 .'README.md:28
  4. Run the container with host networking: 'docker run -t -d --network host curl-http3'README.md:29
  5. Use 'docker exec -it <container_id> bash' to get a shell inside the container.README.md:32
  6. Execute the attack script: './http3-flood.sh'README.md:32
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and script only build a tool and execute a network flood against an operator-specified target. There is no evidence of host compromise, data exfiltration, persistence, or any action targeting the Docker host or unrelated systems. The use of --network host and docker exec are documented prerequisites for the exercise and do not constitute malicious behavior.

http3-flood/Dockerfile:1-49http3-flood/http3-flood.sh:1-11README.md:25-32
Review boundaries

What the analysis did not establish

  • The http3-flood.sh script contains a placeholder URL that must be replaced by the operator; the actual target is unknown.
  • The relationship between the provided flood script and CVE-2022-30592 is not demonstrated in the supplied evidence.
  • The Dockerfile copies a local file 'http-flood.sh' but the provided script is named 'http3-flood.sh'; this discrepancy is not explained.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3