PT-2023-21567 · Docker · Play With Docker

Cokebeer · Published 2023-03-16 · Updated 2023-03-23 · CVE-2023-28109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Play With Docker versions 0.0.2 and prior

Description Play With Docker is a browser-based Docker playground. The issue arises from incorrect CORS configuration, allowing an attacker to bypass the CORS policy by setting the origin header in an HTTP request to a malicious domain, such as evil-play-with-docker.com, which would then be echoed in the response header, successfully retrieving basic user information.

Recommendations For versions 0.0.2 and prior, upgrade to the latest version to fix the issue. As a temporary workaround, consider restricting access to the play-with-docker.com domain to minimize the risk of exploitation. There are no known workarounds other than upgrading to the latest version.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-28109

GHSA-VQ59-5X26-H639

Affected Products

Play With Docker

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28109.json · Exploit
• https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a · Patch
• https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28109 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28109 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vq59-5x26-h639 · Vendor Advisory
• https://github.com/play-with-docker/play-with-docker · Note
• https://t.me/cibsecurity/60168 · Telegram Post
• https://t.me/cvenotify/46344 · Telegram Post