ExploitWP2Docker: a Platform for Automating the Generation of Vulnerable WordPress Environments for Cyber Ranges

TL;DR

ExploitWP2Docker addresses the labor-intensive task of creating vulnerable environments for cyber ranges by automatically translating public WordPress exploits into runnable WordPress stacks inside Docker. It leverages ExploitDB to extract PoC data, uses CVE-to-CPE mapping to locate base images, and assembles Docker-based vulnerable configurations including core, plugins, and themes. The evaluation demonstrates that about $39\%$ of WordPress exploits can be automated to generate 484 configurations, highlighting both feasibility and limitations due to missing base images for older WordPress versions. The work suggests broadening to additional CMS and exploring alternative virtualization like MicroVMs to improve coverage and isolation.

Abstract

A cyber range is a realistic simulation of an organization's network infrastructure, commonly used for cyber security training purposes. It provides a safe environment to assess competencies in both offensive and defensive techniques. An important step during the realization of a cyber range is the generation of vulnerable machines. This step is challenging and requires a laborious manual configuration. Several works aim to reduce this overhead, but the current state-of-the-art focuses on generating network services without considering the effort required to build vulnerable environments for web applications. A cyber range should represent a real system, and nowadays, almost all the companies develop their company site by using WordPress, a common Content Management System (CMS), which is also one of the most critical attackers' entry points. The presented work proposes an approach to automatically create and configure vulnerable WordPress applications by using the information presented in public exploits. Our platform automatically extracts information from the most well-known publicly available exploit database in order to generate and configure vulnerable environments. The container-based virtualization is used to generate lightweight and easily deployable infrastructures. A final evaluation highlights promising results regarding the possibility of automating the generation of vulnerable environments through our approach.

Figures (4)

• Figure 1: WordPress Exploit
• Figure 2: Number of vulnerable downloaded applications for site - WordPress
• Figure 3: Number of generation divided by year - WordPress
• Figure 4: Error of generations divided by year - WordPress