{"uuid": "44ad67bd-e51e-40cd-b9d1-764420f6d6f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-41110", "type": "seen", "source": "https://t.me/tech_b0lt_Genona/4579", "content": "Problem\n\nDocker\u2019s default authorization model is all-or-nothing. Users with access to the Docker daemon can execute any Docker command. For greater access control, authorization plugins (AuthZ) can be used. These plugins approve or deny requests to the Docker daemon based on authentication and command context.\n\nIn 2018, a security issue was discovered where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later versions, resulting in a regression.\n\nVulnerability details\n\nAuthZ bypass and privilege escalation: An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly if not set to deny by default.\nInitial fix: The issue was fixed in Docker Engine v18.09.1 January 2019.\nRegression: The fix was not included in Docker Engine v19.03 or newer versions. This was identified in April 2024 and patches were released for the affected versions on July 23, 2024. The issue was assigned CVE-2024-41110.\n\n. . .\n\nWho is impacted?\nUsers of Docker Engine v19.03.x and later versions who rely on authorization plugins to make access control decisions.\n\nDocker Security Advisory: AuthZ Plugin Bypass Regression in Docker Engine\nhttps://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin/", "creation_timestamp": "2024-07-26T08:59:19.000000Z"}