PT-2021-15548 · Unknown · Docker-Cli-Js

Paul-Emmanuel Raoul · Published 2021-11-22 · Updated 2022-03-29 · CVE-2021-23732

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions docker-cli-js versions all

Description The issue affects the Docker.command method in the docker-cli-js package. If a user can partially control the command parameter of this method, they can execute arbitrary OS commands on the host system. This allows for potential exploitation, enabling attackers to run any command on the system.

Recommendations Since all versions are affected and there is no information about a specific fixed version, the following recommendation applies: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-23732

GHSA-FF45-7PRW-58VJ

Affected Products

Docker-Cli-Js

References · 9

• 🔥 https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23732 · Security Note
• https://osv.dev/vulnerability/GHSA-ff45-7prw-58vj · Vendor Advisory
• https://github.com/Quobject/docker-cli-js · Note
• https://github.com/Quobject/docker-cli-js/issues/22#issuecomment-967760940 · Note
• https://github.com/Quobject/docker-cli-js/issues/22 · Note
• https://t.me/cvenotify/23955 · Telegram Post
• https://security.netapp.com/advisory/ntap-20211223-0004 · Note
• https://t.me/cibsecurity/32806 · Telegram Post