Executive brief
docker2aci is a tool used to convert Docker container images into the App Container Image (ACI) format. A security flaw allows a specially crafted, malicious container image to write files to unintended locations on the system during the conversion process. If an administrator or automated system converts an untrusted image, it could result in the overwriting of sensitive system files or the placement of malicious scripts, potentially leading to a full system compromise.
Technical details
A directory traversal vulnerability exists in docker2aci's image conversion logic. The root cause is a lack of validation on layer IDs within the embedded layer data of a Docker image. When `extractEmbeddedLayer` is called, it uses the provided layer ID to construct a file path using `path.Join` without sanitizing for ".." (dot dot) sequences. An attacker can craft a malicious image with layer IDs containing traversal strings (e.g., `../../../etc/`) to break out of the temporary directory and write files to arbitrary locations on the filesystem. While many public registries validate layer IDs, this remains a risk when converting images from untrusted or non-conformant sources. The issue is fixed in version 0.13.0.
Affected products
- appc docker2aci before 0.13.0
Timeline
- 2016-09-27: disclosed: Issue reported on GitHub repository
- 2016-10-24: patched: Version 0.13.0 released with fix
- 2017-01-27: advisory: NVD publication date