Description
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Tecnativa docker-socket-proxy
Default version status: unaffected
0 to ≤ 0.5.0affected
pkg:docker/tecnativa/docker-socket-proxyReferences
- https://github.com/Tecnativa/docker-socket-proxy/issues/182 ↗
- https://github.com/Tecnativa/docker-socket-proxy ↗
- https://github.com/Tecnativa/docker-socket-proxy/blob/v0.5.0/haproxy.cfg#L49-L61 ↗
- https://github.com/Tecnativa/docker-socket-proxy/pull/183 ↗
- https://gist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732 ↗
- https://www.vulncheck.com/advisories/docker-socket-proxy-through-insufficient-access-control-granularity-exposes-container-filesystems ↗