Vulhub Vulnerable Environments

CVE-2019-14234 is a SQL injection vulnerability in Django affecting JSONField and HStoreField model fields. The vulnerability exists when a developer uses these fields and allows users to control the key names within a QuerySet.

Affected Versions:

• Django 2.2.4, 2.1.11, and 1.11.23 and all versions prior to these releases.

Vulnerability Context: Django's built-in admin interface is susceptible to this vulnerability, which can be used to demonstrate the exploit by manipulating query parameters related to these fields.

uWSGI is a web application server implementing protocols like WSGI, uwsgi, and HTTP. It is commonly used to run Python web applications and acts as a communication standard between front-end servers (like Nginx or Apache) and back-end application containers.

The vulnerability arises because uWSGI supports dynamic configuration of back-end web applications via Magic Variables. If the uWSGI port is exposed to the internet, an attacker can construct a uwsgi data packet specifying the UWSGI_FILE magic variable and use the exec:// protocol to execute arbitrary commands on the system.

GNU InetUtils versions 1.9.3 through 2.7 contain a remote authentication bypass vulnerability (CVE-2026-24061). The telnetd server fails to filter the USER environment variable before passing it to the login(1) program. An attacker can provide a value such as -froot to trigger the login program's authentication bypass feature (-f flag), gaining root access without credentials.

• Vulnerability Type: Parameter Injection (CWE-88)
• CVSS v3.1 Score: 9.8 (Critical)

Scrapyd is a cloud service for the Scrapy crawling framework that allows users to deploy Scrapy packages. By default, it listens on port 6800. If this port is accessible to an attacker, they can deploy malicious code to the server and potentially gain full server access.

Reference: https://www.leavesongs.com/PENETRATION/attack-scrapy.html

AppWeb is an embedded Web Server developed by Embedthis Software LLC, written in C/C++. It is commonly used as a Web Application container for embedded devices.

AppWeb supports three authentication methods:

• basic: Traditional HTTP Basic Authentication.
• digest: Improved HTTP Basic Authentication; once authenticated, it uses Cookies to maintain state instead of the Authorization header.
• form: Form-based authentication.

Vulnerability Detail: In versions prior to 7.0.3, a logic error exists in the digest and form authentication methods. If a user provides a null password (i.e., the password parameter is missing), AppWeb incorrectly validates the authentication and returns a session, allowing unauthorized access.

Vite versions 6.0.0 to <6.4.2, 7.0.0 to <7.3.2, and 8.0.0 to <8.0.5 are vulnerable to arbitrary file reading via the WebSocket interface. The vulnerability exists because file system access controls (like server.fs.allow and server.fs.deny) are not applied to the fetchModule method exposed via WebSocket.

Conditions for exploitation:

• The Vite development server must be explicitly exposed to the network (using the --host flag or server.host configuration).
• An attacker must be able to access the WebSocket interface.

Mechanism: An attacker can call the fetchModule method using a custom vite:invoke event. By combining the file:// protocol with ?raw or ?inline query parameters, the attacker can read any file accessible to the Node.js process as a JavaScript module string.

CVE-2024-47177 is a remote command execution vulnerability in OpenPrinting Cups-Browsed (versions 2.0.1 and earlier). The vulnerability stems from improper handling of the FoomaticRIPCommandLine parameter within PPD (PostScript Printer Description) files.

An attacker can exploit this by hosting a malicious IPP (Internet Printing Protocol) server. When a vulnerable cups-browsed instance discovers the malicious server, it receives crafted printer information containing a malicious payload in the printer-privacy-policy-uri attribute. This payload is injected into a temporary PPD file created by cups-browsed. The command execution is triggered when a print job is sent to the newly discovered malicious printer.

The S2-045 vulnerability affects specific versions of Apache Struts 2. It allows for Remote Code Execution (RCE) via improper handling of the Content-Type header during multipart parsing.

Affected Versions:

• Struts 2.3.5 - Struts 2.3.31
• Struts 2.5 - Struts 2.5.10

CVE-2025-30208 is a vulnerability in Vite's development server that allows bypassing the server.fs.deny restriction. This restriction is intended to prevent access to files outside the allowed file system scope.

In versions prior to Vite 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10, an attacker can read arbitrary files on the file system by appending specific query strings to the @fs prefix in the URL. The bypass occurs because trailing separators (like ?) are removed during request processing but are not accounted for in the query string regular expressions used for security checks.

Affected Versions:

• Prior to 6.2.3
• Prior to 6.1.2
• Prior to 6.0.12
• Prior to 5.4.15
• Prior to 4.5.10

This environment demonstrates a vulnerability in Tomcat 7+ where weak credentials allow an attacker to access the management backend. Once access is gained, an attacker can deploy a .war file to the web directory to achieve remote code execution (webshell).

Key Concepts:

• Deployment: Tomcat allows deploying .war files via the backend, which can be used to place a webshell in the web directory.
• Permissions: Access depends on the specific roles assigned to the user in conf/tomcat-users.xml.
• Default Security: In a standard installation, Tomcat has no default users and the manager page is restricted to local IP addresses. This vulnerability requires manual misconfiguration (weak passwords and permissive access).

CVE-2021-4034 is a local privilege escalation vulnerability in Polkit's pkexec utility.

Mechanism: pkexec is a setuid tool designed to allow unprivileged users to run commands as privileged users based on predefined policies. The vulnerability exists because pkexec does not correctly handle the argument count (argc). An attacker can manipulate environment variables to induce pkexec to execute arbitrary code, leading to full administrative rights on the target machine.