docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.3epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
Tecnativa · docker-socket-proxypublic PoCs found — 1
cve_referencegist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://gist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732https://github.com/Tecnativa/docker-socket-proxyhttps://github.com/Tecnativa/docker-socket-proxy/blob/v0.5.0/haproxy.cfg#L49-L61https://github.com/Tecnativa/docker-socket-proxy/issues/182https://github.com/Tecnativa/docker-socket-proxy/pull/183https://www.vulncheck.com/advisories/docker-socket-proxy-through-insufficient-access-control-granularity-exposes-container-filesystems