CVE-2020-24264

Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/portainer/portainer/issues/4106	Third Party Advisory
https://github.com/portainer/portainer/issues/4106	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:portainer:portainer:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:14

Type	Values Removed	Values Added
References	~~() https://github.com/portainer/portainer/issues/4106 - Third Party Advisory~~	() https://github.com/portainer/portainer/issues/4106 - Third Party Advisory

Information

Published : 2021-03-16 15:15

Updated : 2024-11-21 05:14

NVD link : CVE-2020-24264

Mitre link : CVE-2020-24264

CVE.ORG link : CVE-2020-24264

JSON object : View

Products Affected

portainer

portainer

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2020-24264", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-03-16T15:15:12.607", "references": [{"url": "https://github.com/portainer/portainer/issues/4106", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/portainer/portainer/issues/4106", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover."}, {"lang": "es", "value": "Portainer versiones 1.24.1 y anteriores, est\u00e1n afectados por un control de acceso incorrecto que puede conllevar a una ejecuci\u00f3n de c\u00f3digo arbitraria remota. Las comprobaciones de restricci\u00f3n para los montajes de enlace se aplican solo en el lado del cliente y no en el lado del servidor, lo que puede conllevar a generar un contenedor con montaje de enlace. Una vez que es generado un contenedor de este tipo, puede ser aprovechado para salir del contenedor y completar la toma de control de la m\u00e1quina host de Docker"}], "lastModified": "2024-11-21T05:14:32.907", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA8836F8-EA3E-4DCB-9B6B-FA6111980475", "versionEndIncluding": "1.24.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}