Docker Engine < 23.0.15 / 26.x < 26.1.5 / 27.x < 27.1.1 Authentication Bypass

critical Nessus Plugin ID 204784

Language:

Synopsis

The remote host has an application installed that is affected by an authentication bypass vulnerability.

Description

The version of the Docker Engine (Moby) installed on the remote host is prior to 23.0.15, 26.x prior to 26.1.5 or 27.x prior to 27.1.1. It is therefore affected by an authentication bypass vulnerability. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Docker Engine version 23.0.15, 26.1.5, 27.1.1 or later

Plugin Details

Severity: Critical

ID: 204784

File Name: docker_cve-2024-41110.nasl

Version: 1.2

Type: local

Family: Misc.

Published: 7/26/2024

Updated: 7/29/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.9

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-41110

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:docker:docker

Required KB Items: installed_sw/Docker

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/24/2024

Vulnerability Publication Date: 7/23/2024

Reference Information

CVE: CVE-2024-41110

IAVA: 2024-A-0438

Detections

Analytics