CVE-2023-4863 — libwebp Exploitation Lab

Reproduction of CVE-2023-4863 (heap buffer overflow in libwebp) in a fully isolated automated Docker environment. Based on the practice from the Ethical Hacking module of CEFIRE.

What this lab does

Spins up eight containers on a private network:

The automatic demonstration (victim-cli vs victim-patched) happens on its own at startup. The visual GUI demonstration requires manual interaction from Guacamole.

Requirements

• Docker Engine 24+
• Docker Compose v2
• ~5 GB of RAM available
• ~10 GB of disk (images + layers)

Start the lab

make up

make up does three things automatically if it's the first time:

1. Generates the Guacamole SQL schema (runs initdb.sh from the official image)
2. Builds the container images
3. Starts everything

The build takes a few minutes the first time (downloads base images, clones the PoC repo, installs packages). Subsequent runs use the Docker cache and are almost instantaneous.

When it finishes, you will see the Guacamole URL in the output. The victim containers do not start until the attacker is ready and serving the exploit (healthcheck).

Credentials

View the automatic demonstration (CLI)

In a terminal, while the lab is running:

# See the crash on the vulnerable victim
make logs-victim-cli

# See the controlled response on the patched victim
make logs-victim-patched

What you will see on victim-cli:

[*] Running: dwebp /tmp/exploit.webp -o /tmp/salida.png

Decoding of exploit.webp failed.
Status: 3(BITSTREAM_ERROR)
*** glibc detected *** double free or corruption (!prev) ***
Aborted (core dumped)

[!] EXIT CODE: 134 (SIGABRT)
[!] CVE-2023-4863 CONFIRMED

What you will see on victim-patched:

[*] Running: dwebp /tmp/exploit.webp -o /tmp/salida.png

Decoding of exploit.webp failed.
Status: 3(BITSTREAM_ERROR)

[+] EXIT CODE: 1 — Controlled error
[+] CVE-2023-4863 MITIGATED

Visual demonstration on the desktop (GUI)

The most visual demonstration is comparing victim-gui (vulnerable) with victim-gui-patched (patched) using dwebp from a terminal on the XFCE desktop.

Steps

1. Open http://localhost:8888/guacamole in your browser
2. Login: guacadmin / guacadmin
3. On the vulnerable victim (Firefox 110):
   • Select [VICTIM GUI] VNC — Chrome Desktop
   • Open a terminal on the XFCE desktop
   • Run:
     root@kitploit:~

     firefox --no-sandbox http://attacker/index.html
     

   • Firefox 110 tries to render exploit.webp → crash (SIGABRT, process killed)
4. On the patched victim (Firefox 126):
   • Select [VICTIM GUI PATCH] VNC — Chrome Desktop patch
   • Same command → Firefox 126 handles the error without crashing

Why Firefox instead of Chrome

Mozilla maintains a permanent public archive of all its versions at releases.mozilla.org. Google removed the URLs for old Chrome versions from its CDN, making it impossible to reliably download Chrome 116. Firefox 110 is equally vulnerable (both embed libwebp internally) and its download from the Mozilla archive is stable and reproducible.

Direct SSH access (without Guacamole)

ssh root@localhost -p 2220   # attacker
ssh root@localhost -p 2221   # victim-cli
ssh root@localhost -p 2223   # victim-patched
ssh root@localhost -p 2222   # victim-gui
ssh root@localhost -p 2224   # victim-gui-patched

Direct VNC: localhost:5900 (victim-gui) and localhost:5901 (victim-gui-patched).

Useful commands

make logs                    # all logs in real time
make status                  # container status
make shell-attacker          # shell on attacker
make shell-victim-cli
make shell-victim-gui
make shell-victim-gui-patched
make down                    # stop the lab
make clean                   # stop + delete images and networks

Notes

Chrome and libwebp: Chrome bundles its own copy of libwebp (does not use the system one). Versions ≥ 116.0.5845.187 include the patch. Since Google removed URLs for old versions, the Dockerfile falls back to the current stable version (patched). The crash demonstration with dwebp is equally valid and more reliable.

Isolated network: no container has Internet access during execution. All traffic stays within the private Docker network cve4863-lab-net.