—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Authorization Bypass Vulnerability in Docker Engine

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: HIGH

Software Affected

Docker Engine versions prior to 29.3.1

Overview

A vulnerability has been reported in Docker Engine which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances and gain unauthorized privileged access to the host file system.

Target Audience:

All organizations and individuals using Docker Engine.

Risk Assessment:

Potential for compromise of system integrity on the targeted system.

Impact Assessment:

Potential for unauthorized access to sensitive files (such as cloud credentials, SSH keys and Kubernetes configurations), bypass security restrictions and unauthorized actions on the affected system.

Description

Docker Engine is the core open-source runtime and orchestration technology used to build, manage and run containerized applications.

The vulnerability exists in Docker Engine due to improper handling of oversized HTTP request bodies in the fix for CVE-2024-41110. An attacker can exploit this vulnerability by sending a specially crafted API request that omits the request body when forwarded to an authorization plugin.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances and gain unauthorized privileged access to the host file system.

Solution

Upgrade to the latest versions as mentioned in the advisory:

https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2

Workaround

If unable to update immediately:

Restrict local access to Docker daemon hosts to trusted users only.

Implement additional access controls at the network and host level independent of AuthZ plugins.

Vendor Information

Docker

https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2

References

https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0223

CVE Name

CVE-2026-34040

CVE-2024-41110

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmnY/bwACgkQ3jCgcSdc

ys8ePg/+LJpcSFNwALNeCdtYIix2aw/4oek7exIA0CCpBuCkD4gQlrWNFwi3IyTC

5y1cvYQn+33KikadFCslDmZJO3kSTl8hMN04NAr6Qlm33WpNPnFKPx4mxdoWykew

zGZ9IsKEUpEpqOrgOYCdw1usApb+/VwcCNNEnn8/9zka+7vDTYL5Av8OyeYuVpHR

Yys5dFe8DKKy+sALUMFDMxqtnx+7SbDkeL/rVaUydg2SVILszrt7Mz7gYHsm2hh/

J8ypU0zNFmRogHHuMgtlALNNkr4hTdo0M49phMwpL9lHt+2zrE6S12JA0TfJo6gS

vfYUA3mxEUJL6fBvbH1rmmUbFXZFimk7xxZ0IX3IzmCA+q1oOwpaqD2GpzABE2DV

eGu9QHdlNvXlTG+mj+ZAUGGW708chmaBlfxMv7sFzJ0zVaLaYs02irpRTvcjqK7n

F0/8ajBs3u/DiQn1a6LnCm0IPOK8LC3Zdg3V1X7UTylTeD2k6ajNxTRFHTsqXC9p

FSPM0Giod1CzS1NHTgPkvEeUMyS+/qVxHglXVr06K76Um76KuVSF0c3dIrwxzZBm

pxV/Haxippmo0bhznF9dDvmMcVidPKoA4HSzJnOXb/VUvThWAtl6eQI7QZvskdp3

UOYsDI5IVgxk7D1vZeMzPYZgROAeMMUViq5TniXe5yg7IJ0VOpQ=

=KSPg

—–END PGP SIGNATURE—–