evillm/cve-2025-27520-pocSafe educational simulation of CVE-2025-27520 with a Flask vulnerable service and Python PoC scanner for demonstrating deserialization and broken access control vulnerabilities.
⚠️ Important: This is a safe educational simulation of the CVE-2025-27520 vulnerability.
The project includes a simulation service (Flask) and a safe PoC scanner (Python).
On receiving a test marker, the simulation creates an evidence file indata/instead of executing arbitrary commands.
CVE-2025-27520-final/
├── 📄 README_ru.md # This documentation file
├── 🐳 Dockerfile # Stand image (Flask)
├── 🐳 docker-compose.yml # Container launch configuration
├── 📊 result.json # Example scanner result
├── ⚙️ setup.cfg # flake8 configuration
├── 📁 app/ # Service source code
│ ├── 🐍 app.py # Flask simulation service
│ └── 📦 requirements.txt # Service dependencies
├── 📁 src/ # Scanner source code
│ ├── 🐍 scanner.py # PoC / scanner (Python)
│ └── 📦 requirements.txt # Scanner dependencies
├── 📁 data/ # Mounted folder for evidence
---
## 🎯 Vulnerability Brief Description
**CVE-2025-27520 (simulation)** — demonstration of vulnerable deserialization / broken access control
**In a real product this could lead to:**
- Privilege escalation
- Remote code execution
- Disclosure of confidential data
**In this educational version we:**
- Safely confirm the vulnerability by creating an evidence file
- Provide a lightweight stand for local testing
- Follow responsible disclosure principles
---
## 🛠 System Requirements
- **OS:** Linux
- **Docker:** Docker
- **Python:** 3.11 or newer
---
## 🚀 Quick Start
### 1. Start the Service
```bash
docker-compose up -d
curl http://127.0.0.1:5000/health
Expected response: {"status":"ok"} or HTTP 200
python3 -m venv venv
source venv/bin/activate
pip install -r src/requirements.txt
python3 src/scanner.py --url http://127.0.0.1:5000
cat result.json
ls -l data/
cat data/EVIDENCE_LANG_BENTO_SIM.txt
# In the project root
docker-compose build --no-cache
docker-compose up -d
docker ps
docker-compose ps
docker logs bento-sim --tail 100
Expected result: container bento-sim in Up state with port forwarding 0.0.0.0:5000->5000/tcp
--url parametersource venv/bin/activate
python3 src/scanner.py --url http://127.0.0.1:5000
[
{
"ip": "http://127.0.0.1:5000",
"vuln": true
}
]
Main endpoints:
POST /simulate_deserialize - accepts JSON with key payloadGET /evidence - checks for the existence of an evidence fileGET /health - service health checkLogic:
EVIDENCE_TRIGGER, creates an evidence file0.0.0.0:5000data/EVIDENCE_LANG_BENTO_SIM.txt - evidence file, created on successful simulationresult.json - scan results, generated by the PoC scriptvuln: falsedocker ps
curl http://127.0.0.1:5000/health
curl -v -X POST http://127.0.0.1:5000/simulate_deserialize \
-H "Content-Type: application/json" \
-d '{"payload":"Hello EVIDENCE_TRIGGER"}'
Expected response: {"result":"evidence created"}
docker logs bento-sim --tail 200
sudo ss -ltnp | grep 5000
sudo iptables -L -n -v
pip install black autopep8
black src/scanner.py
# or
autopep8 --in-place --aggressive --aggressive src/scanner.py
7z a -v3g -m0=Copy "CVE-2025-27520-stand.7z" "file.ova"
tar -tf file.ova | head -n 20
File → Import in VMware Workstation / VirtualBoxCVE-2025-27520-final/
├── 📄 README_ru.md
├── 🐳 Dockerfile
├── 🐳 docker-compose.yml
├── 📁 app/
├── 📁 src/
├── 📊 result.json
├── 📁 data/
zip -r CVE-2025-27520-final.zip CVE-2025-27520-final
sha256sum CVE-2025-27520-final.zip > CVE-2025-27520-final.zip.sha256
# For ZIP
unzip -t CVE-2025-27520-final.zip