Critical Docker Vulnerability Lets Hacker Bypass Authentication
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
A critical security vulnerability in Docker Engine has been discovered, potentially allowing attackers to bypass authentication and gain unauthorized access to systems.
The vulnerability, identified as CVE-2024-41110, affects multiple versions of Docker Engine and has been assigned a CVSS score of 10, indicating the highest level of severity.
The issue stems from a regression in Docker’s authorization plugin (AuthZ) system.
An attacker could exploit this vulnerability by crafting a special API request with a Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin.
This could result in the plugin incorrectly approving the request, leading to unauthorized actions and potential privilege escalation.
Affected Versions And Impact
The vulnerability affects Docker Engine version 19.03.x and, later, specifically, those configured to use AuthZ plugins. Users not employing AuthZ plugins or running older Docker Engine versions are not susceptible. The following versions are affected:
#computer_Security #Cyber_Security #Cyber_Security_News #Vulnerability #Authentication_Bypass #CVE-2024-41110 #Docker_Security
Оригинальная версия на сайте:
Critical Docker Vulnerability Lets Hacker Bypass Authentication
Author: Raga VarshiniA critical security vulnerability in Docker Engine has been discovered, potentially allowing attackers to bypass authentication and gain unauthorized access to systems.
The vulnerability, identified as CVE-2024-41110, affects multiple versions of Docker Engine and has been assigned a CVSS score of 10, indicating the highest level of severity.
The issue stems from a regression in Docker’s authorization plugin (AuthZ) system.
An attacker could exploit this vulnerability by crafting a special API request with a Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin.
This could result in the plugin incorrectly approving the request, leading to unauthorized actions and potential privilege escalation.
Affected Versions And Impact
The vulnerability affects Docker Engine version 19.03.x and, later, specifically, those configured to use AuthZ plugins. Users not employing AuthZ plugins or running older Docker Engine versions are not susceptible. The following versions are affected:
- Docker Engine:
#computer_Security #Cyber_Security #Cyber_Security_News #Vulnerability #Authentication_Bypass #CVE-2024-41110 #Docker_Security
Оригинальная версия на сайте:
