CVE-2024-3094

CVE-2024-3094 Lab Environment Setup and Report

CVE-2024-3094 Practice

Reproduced the backdoor inserted in XZ Utils 5.6.0 and 5.6.1 in a lab environment, analyzing SSH authentication hooking status and risks.

Environment

• Host OS : - Windows 11
• Docker : Docker Desktop 28.0.1
• Dockerfile Base Image : debian:experimental-20240311
• liblzma5 version : 5.6.0
• SSH Port : 2222 (root / pw : whs)

Dockerfile

docker-compose.yaml

Practice Process

1. Write Dockerfile + docker-compose.yaml

2. Build and run the container docker compose up --build -d

3. Access the system via SSH ssh root@localhost -p 2222 #password : whs

4. Confirm liblzma5 version is 5.6.0 using dpkg dpkg -l | grep liblzma

5. Check if sshd uses liblzma.so ldd /usr/sbin/sshd | grep lzma

• No output -> In this lab environment, the sshd binary does not appear to be dynamically linked with liblzma.so, but the vulnerable version of liblzma5 is confirmed installed. Also, the possibility of running the PoC was confirmed.

6. Write PoC script file name : poc_detect_backdoor.sh

7. Execution result chmod +x poc_detect_backdoor.sh ./poc_detect_backdoor.sh

From the results, we confirmed that the PoC script executed successfully within the container, and it was possible to verify that the lab environment was properly set up using only the Dockerfile and docker-compose.yaml.

Conclusion

• Configured a Docker environment based on the vulnerable version containing the XZ backdoor, checked whether sshd references the library, and performed basic PoC execution to verify operation.
• Confirmed that it is reproducible using only the Dockerfile and docker-compose.yaml.
• Methods to mitigate this vulnerability include removing the vulnerable XZ version or upgrading to a patched version.