Executive brief
docker-cli-js is a Node.js library that provides a command interface for Docker. The library fails to sanitize user input passed to the Docker.command method, allowing attackers to inject arbitrary OS commands if any part of the command parameter is controlled by an untrusted user. This could lead to complete system compromise by executing malicious commands on the host machine.
Technical details
The vulnerability is an OS command injection flaw (CWE-78) in the docker-cli-js library affecting all versions up to 2.8.0. The Docker.command method constructs shell commands by concatenating user-supplied input without sanitization or parameterization, passing them directly to child_process execution. An attacker who can control even part of the command parameter (e.g., a container name in a Docker run command) can inject shell metacharacters like semicolons to execute arbitrary OS commands with the privileges of the Node.js process. The vulnerability is network-reachable if the application exposes the Docker command functionality through a web interface or API. The advisory was withdrawn on 2021-11-29 following maintainer response, though the underlying issue remains a design flaw in the library.
Affected products
- Quobject docker-cli-js up to 2.8.0
Timeline
- 2021-11-22: disclosed: NVD publication date
- 2021-12-02: disclosed: Advisory published
- 2021-11-29: other: Advisory withdrawn following maintainer response