Test an LB rule with a managed CVE lab

Use mockforge cve to reproduce Next.js CVE-2025-29927 against a real vulnerable application, then test the same request through your load balancer. MockForge downloads pinned Vulhub and Nuclei container images, runs the checks, records the evidence, and removes its containers after the run.

This first pack supports Linux amd64 with Python 3.11+ and a local Docker or Podman engine. Install those prerequisites separately. No Compose installation, pip packages, Nuclei installation, or source checkout is required.

Check prerequisites

mockforge cve doctor
mockforge cve list

For Podman, put --engine podman before the subcommand:

mockforge cve --engine podman doctor

The catalog contains only reviewed packs. An unsupported CVE fails before any download or request. Image versions are pinned by digest. Upgrading MockForge updates the reviewed catalog; runs do not silently select newer image tags or community templates.

Run the direct application baseline

mockforge cve run CVE-2025-29927 --output-dir nextjs-baseline

On first use, the command downloads the required images. Subsequent runs reuse the image cache. To download them ahead of time, run:

mockforge cve prepare CVE-2025-29927

A successful baseline reports baseline-confirmed: an ordinary request receives an authentication redirect, and the test request reaches the protected dashboard. This result does not test an LB. The application and test client stop automatically. Each invocation requires a new output directory to preserve earlier evidence.

Test your load balancer

Configure your test LB to forward to the lab recorder on port 18082. The recorder forwards requests to the real vulnerable application and records which requests reached the origin. It runs only for the duration of the command.

For an LB on the same host:

mockforge cve run CVE-2025-29927 \
  --target https://your-test-lb.example \
  --output-dir nextjs-lb-test

The recorder binds to 127.0.0.1 by default. For a remote LB, bind to a specific isolated lab interface, then configure the LB’s upstream to that address:

mockforge cve run CVE-2025-29927 \
  --listen-address 192.168.2.10 --origin-port 18082 \
  --target https://your-test-lb.example \
  --output-dir nextjs-lb-test

Replace the address with your lab host’s address. This exposes a vulnerable lab through the recorder, so keep that interface accessible only to the test network. The application container itself publishes only on loopback. Remote Docker engines and non-Linux container hosts are not supported by this pack.

Preserve the X-Mockforge-Cve header and __mockforge_cve query parameter through the LB. Use a trusted HTTPS certificate for the LB. There is no TLS-verification bypass option. If the configured rejection code differs from 403, pass --block-status with that code.

Read the report

Open report.json in the output directory. The directory also retains Nuclei’s request and response evidence, the exact generated templates, application logs, and container ownership information.

  • pass: the direct reproduction succeeded, the LB returned the expected rejection, no correlated signature request reached the origin during the observation window, and benign requests reached the application.
  • fail: the signature request reached the origin, including cases where the LB returned a rejection after forwarding it.
  • inconclusive: the application baseline, client execution, routing, control requests, or expected response could not be verified.
  • baseline-confirmed: the direct reproduction succeeded without an LB target.

Only pass and baseline-confirmed exit successfully. Nuclei observations in this pack match any HTTP response for evidence collection. A Nuclei JSON row is not itself a vulnerability finding; use MockForge’s final verdict.

This tests one request-blocking scenario. It does not establish protection against every CVE variant, prove that the application was patched, or evaluate an LB policy that intentionally forwards a sanitized request. PHP2Shell, Log4Shell, and other CVEs are not managed packs in this release. The older CVE signature tools remain available separately.

Recover an interrupted run

Normal completion, errors, and handled termination attempt to remove only the containers owned by the run. After a forced kill or host interruption, run:

mockforge cve down --output-dir nextjs-lb-test

Use the same engine as the original run. Cleanup checks container ownership labels before removing anything. Reports and cached images remain available.