Shipped in MockForge 0.3.241

Test a load balancer rule with a CVE exposure lab

MockForge managed CVE labs run a reviewed vulnerable application and send a reproduction through your test load balancer. The recorder observes whether attack traffic reaches the origin and saves the evidence. Release 0.3.241 makes pack definitions data-driven and reports the conclusion in plain language.

This release includes the managed Next.js CVE-2025-29927 pack. PHP2Shell and Node2Shell are planned, and are not available packs in 0.3.241.

What does the verdict mean?

A run prints either EXPOSED or NOT exposed, followed by a reason and evidence checks. The checks are also stored in report.json. Here is real output from a local MockForge 0.3.241 lab run on 127.0.0.1:

Lab ready. LB upstream: 127.0.0.1:18082
fail: http://127.0.0.1:18090 is EXPOSED to CVE-2025-29927: attack traffic reached your origin past the LB/WAAP
Reason: signature request reached the origin; blocking assertion failed
Details:
  - direct baseline reproduces the vulnerability: ok
  - benign controls corroborate origin reachability: ok
  - ordinary requests to the protected route match the application redirect: ok
  - every origin request correlates with this run: ok
  - signature request was blocked at the target: not satisfied, reached the origin with status 200
Error: CVE command failed (exit status: 1); see diagnostics above

Lab ready. LB upstream: 127.0.0.1:18082
pass: http://127.0.0.1:18091 is NOT exposed to CVE-2025-29927: the signature request was rejected by your LB/WAAP
Reason: expected rejection with no correlated origin request and healthy controls
Details:
  - direct baseline reproduces the vulnerability: ok
  - benign controls corroborate origin reachability: ok
  - ordinary requests to the protected route match the application redirect: ok
  - every origin request correlates with this run: ok
  - signature request was blocked at the target: ok
  - target response matched the configured block status (403): ok

How do I run the lab?

1. Check prerequisites with mockforge cve doctor and inspect the catalog with mockforge cve list.
2. Configure your test load balancer to forward to the recorder on port 18082.
3. Run a fresh output directory for each test: mockforge cve run CVE-2025-29927 --target https://your-test-lb.example --output-dir nextjs-lb-test.
4. Review the verdict and evidence in the terminal and report.json.

Before starting, the command prints its run plan: recorder endpoint, target, and a warning if the default 127.0.0.1 bind cannot accept a remote load balancer. The catalog also displays each pack’s origin_port and listen-address guidance.

Can I test a self-signed HTTPS target?

Yes. Add --skip-tls-verify to mockforge cve run for a self-signed lab target. Certificate verification remains enabled by default. MockForge warns while the flag is active and records the TLS setting in the report.

Can I prepare an air-gapped lab host?

The managed CVE labs guide describes exporting the pinned container images with docker save on a connected machine, loading them on the lab host with docker load, then running mockforge cve prepare to verify the digests without pulling.

What else changed in 0.3.241?

• Cloud tunnels now refuse unauthenticated cloud destinations.
• Bundled demo samples now serve their real image responses.
• Stripe subscription webhooks reconcile ordered subscription state and handle API-version changes, repeats, unknown events, and prices.
• Protocol support is split out of transport builds, so builds that do not need every protocol compile less.