PT-2024-7385 · Docker+1 · Docker+1

Published 2024-10-14 · Updated 2024-10-29 · CVE-2024-41997

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Warp Terminal versions prior to 2024.07.18 (v0.2024.07.16.08.02)

Description: A command injection vulnerability exists in the Docker integration functionality of Warp Terminal. An attacker can create a specially crafted hyperlink using the warp://action/docker/open subshell intent that, when clicked by the victim, results in command execution on the victim's machine. The issue is related to incorrect code generation management in the Docker Integration component.

Recommendations: For versions prior to 2024.07.18 (v0.2024.07.16.08.02), update to a version released after 2024.07.18 to resolve the issue. As a temporary workaround, consider disabling the Docker integration functionality until a patch is available. Restrict access to the warp://action/docker/open subshell intent to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-08754

CVE-2024-41997

Affected Products

Docker

Warp Terminal

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-41997 · Security Note
• https://bdu.fstec.ru/vul/2024-08754 · Security Note
• https://github.com/warpdotdev/warp · Note
• https://vulners.com/cve/CVE-2024-41997 · Note
• https://twitter.com/CVEnew/status/1845862018315677923 · Twitter Post
• https://vuldb.com/?id.280275 · Note
• https://twitter.com/VulmonFeeds/status/1845953155877543957 · Twitter Post
• https://gist.github.com/bhyh/d1ee7a825fce283bf8acbdb42c8a7832 · Note
• https://docs.warp.dev/getting-started/changelog#id-2024.07.18-v0.2024.07.16.08.02 · Note
• https://t.me/cvedetector/7823 · Telegram Post
• https://docs.warp.dev/features/integrations-and-plugins#docker · Note
• https://t.me/cvenotify/97997 · Telegram Post