kiroloskhairy/cve-2023-27372Safe PoC scanner and Docker lab for CVE-2023-27372, an RCE in SPIP CMS before 4.2.1. Verifies vulnerability via password recovery endpoint without destructive actions.
This repository contains:
stand/ — a lab environment (vulnerable setup) on Docker: SPIP + MariaDB.poc/ — a Python verification tool (scanner) implementing safe confirmation of the vulnerability (Safe PoC) without destructive actions.The project is intended for demonstration and analysis of the vulnerability CVE-2023-27372 in SPIP prior to 4.2.1. The check is performed through the password recovery functionality (endpoint spip.php?page=spip_pass) and confirmed by executing a safe command on the lab side.
.
├── stand/ # Vulnerable lab (SPIP + MariaDB) on Docker Compose
│ ├── docker-compose.yml
│ └── ... (Dockerfile/lab scripts, persist volumes, etc.)
└── poc/ # Safe PoC scanner (Python)
├── Dockerfile
├── README.md # (optional) local PoC documentation
└── src/
├── scanner.py
├── utils.py
└── pyproject.toml
cd stand
docker compose up -d
docker compose ps
The service will be available at:
http://127.0.0.1:8080/http://127.0.0.1:8080/spip.php?page=loginNavigate to poc/ and build the scanner Docker image:
cd ../poc
# If your environment experiences DNS issues during the build, use:
docker build --network=host -t spip-poc-scanner .
If there are no DNS problems, you can use the normal command:
docker build -t spip-poc-scanner .
Recommended command for the local lab:
docker run --rm --network="host" \
-v "$(pwd)":/app/out \
spip-poc-scanner \
-i http://127.0.0.1:8080 \
-o /app/out/results.json
After execution, results.json will be created (example structure):
[
{
"ip": "http://127.0.0.1:8080",
"vuln": true
}
]
If your PoC implementation confirms execution by creating a file (e.g., /tmp/pwned.txt), you can verify this inside the web container.
Option without a hardcoded container name:
cd ../stand
WEB_CID="$(docker compose ps -q web)"
docker exec "$WEB_CID" ls -l /tmp/pwned.txt
If the file exists, this confirms the possibility of command execution within the lab environment.
pip)spip.php?page=spip_passTemporary failure in name resolution during docker buildUse the host network build:
docker build --network=host -t spip-poc-scanner .
Stop and remove volumes:
cd stand
docker compose down -v
docker compose up -d
This project was created solely for educational use and legal testing in your own lab environment. The author is not responsible for any unauthorized use.
---::contentReference[oaicite:0]{index=0}