Path traversal in docker (Alpine package)

1) Path traversal

EUVDB-ID: #VU20501

Risk: Low

CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-15664

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a local attacker to perform directory traversal attacks.

The vulnerability exists due to the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack. A local authenticated attacker can gain read-write access to the host filesystem with root privileges, because "daemon/archive.go" does not do archive operations on a frozen filesystem (or from within a chroot).

Mitigation

Install update from vendor's website.

Vulnerable software versions

docker (Alpine package): 18.09.1-r0 - 18.09.6-r0

CPE2.3

• cpe:2.3:a:alpine:docker_alpine_package:18.09.1-r0:*:*:*:*:alpine_linux:*:3.9
• cpe:2.3:a:alpine:docker_alpine_package:18.09.3-r0:*:*:*:*:alpine_linux:*:3.9
• cpe:2.3:a:alpine:docker_alpine_package:18.09.4-r0:*:*:*:*:alpine_linux:*:3.9

External links

https://git.alpinelinux.org/aports/commit/?id=24924763d56dd80da5430746a238868ab6cc20d5
https://git.alpinelinux.org/aports/commit/?id=00c3f0f4eb9d3c23ff8cde84d3086c07b6eb16bf
https://git.alpinelinux.org/aports/commit/?id=7dfd1bd52137b20d92d1cab6132bdc6d3d04e013
https://git.alpinelinux.org/aports/commit/?id=d8f7d5449b7af4d6ef496bd208602b6ffebf8383

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.