diff --git a/dtale/CVE-2025-0655/README.md b/dtale/CVE-2025-0655/README.md index 4da4c057..5c6db325 100644 --- a/dtale/CVE-2025-0655/README.md +++ b/dtale/CVE-2025-0655/README.md @@ -2,15 +2,28 @@ This directory contains the deployment config for D-Tale instances vulnerable and fixed to CVE-2025-0655. Instances before version 3.16.1 may allow users to potentially execute commands via Global State Override mechanism. +The key difference between this testbed and the Exposed UI testbed is that this one does not explicitly enable custom filters, but still allows RCE. + ## Deployment ```sh -docker-compose up vuln -docker-compose up safe +docker-compose up ``` ## Vulnerable Service -The `vuln` service runs D-Tale v3.16.0. +The `vuln` service runs D-Tale v3.16.0 and is exposed on port 8081. + +To confirm the vulnerability, you need any data to be uploaded and then to send the following request: +``` +curl -vk 'host.docker.internal:8081/dtale/update-settings/1?settings=%7B%22enable_custom_filters%22%3Atrue%7D' +``` +If the response indicates success, the instance is vulnerable. ## Fixed Service -The `safe` service runs D-Tale v3.17.0. +The `safe` service runs D-Tale v3.17.0 and is exposed on port 8082. + +To confirm the vulnerability, you need any data to be uploaded and then to send the following request: +``` +curl -vk 'host.docker.internal:8082/dtale/update-settings/1?settings=%7B%22enable_custom_filters%22%3Atrue%7D' +``` +If the response indicates an error changing the setting, the instance is not vulnerable. diff --git a/dtale/CVE-2025-0655/docker-compose.yml b/dtale/CVE-2025-0655/docker-compose.yml index 697abbe6..22147e30 100644 --- a/dtale/CVE-2025-0655/docker-compose.yml +++ b/dtale/CVE-2025-0655/docker-compose.yml @@ -3,8 +3,8 @@ services: build: context: imgdata/ dockerfile: Vulnerable.Dockerfile - expose: - - "40000" + ports: + - "8081:40000" healthcheck: test: ["CMD", "curl", "-f", "http://localhost:40000"] interval: 30s @@ -14,8 +14,8 @@ services: build: context: imgdata/ dockerfile: Fixed.Dockerfile - expose: - - "40000" + ports: + - "8082:40000" healthcheck: test: ["CMD", "curl", "-f", "http://localhost:40000"] interval: 30s