Executive brief
docker-tester is a Node.js library used to validate Docker configurations. A command injection vulnerability allows attackers to execute arbitrary system commands by crafting a malicious docker-compose.yml file with shell metacharacters in the ports field, potentially compromising any system using this library to parse untrusted compose files.
Technical details
An OS command injection vulnerability (CWE-74) exists in docker-tester through version 1.2.1. The vulnerability is triggered when the library parses a docker-compose.yml file and fails to properly sanitize the 'ports' entry before passing it to shell execution. An attacker can inject shell metacharacters in the ports field to execute arbitrary commands. No authentication or user interaction is required; exploitation occurs when the library processes a crafted compose file. The attack vector is network/local depending on how the library is deployed.
Affected products
- Mintzo docker-tester through 1.2.1
Timeline
- 2022-06-02: disclosed: CVE-2021-34079 published on NVD
- 2022-06-03: advisory: GHSA-rj88-4777-828h published