PT-2023-21567 · Docker · Play With Docker

Cokebeer · Publicado 2023-03-16 · Atualizado 2023-03-23 · CVE-2023-28109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Play With Docker versions 0.0.2 and prior

Description Play With Docker is a browser-based Docker playground. The issue arises from incorrect CORS configuration, allowing an attacker to bypass the CORS policy by setting the origin header in an HTTP request to a malicious domain, such as evil-play-with-docker.com, which would then be echoed in the response header, successfully retrieving basic user information.

Recommendations For versions 0.0.2 and prior, upgrade to the latest version to fix the issue. As a temporary workaround, consider restricting access to the play-with-docker.com domain to minimize the risk of exploitation. There are no known workarounds other than upgrading to the latest version.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-28109

GHSA-VQ59-5X26-H639

Produtos afetados

Play With Docker

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28109.json · Exploit
• https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a · Correção
• https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639 · Aviso do Fabricante
• https://github.com/play-with-docker/play-with-docker · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28109 · Nota de Segurança
• https://t.me/cibsecurity/60168 · Publicação no Telegram
• https://t.me/cvenotify/46344 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28109 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vq59-5x26-h639 · Aviso do Fabricante