CVE-2021-23732
📋 TL;DR
CVE-2021-23732 is a command injection vulnerability in docker-cli-js package that allows attackers to execute arbitrary operating system commands on the host system if they can partially control the command parameter. This affects all versions of docker-cli-js package. Developers using this package in applications where user input reaches the Docker.command method are vulnerable.
💻 Affected Systems
- docker-cli-js
📦 What is this software?
Docker Cli Js by Quobject
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute any command as the user running the docker-cli-js process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Remote code execution leading to application compromise, data exfiltration, or cryptocurrency mining malware installation.
If Mitigated
Limited impact if proper input validation and sanitization are implemented, restricting command injection attempts.
🎯 Exploit Status
Exploitation is straightforward - attacker needs to inject shell commands through the command parameter. Public proof-of-concept code exists demonstrating the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version of docker-cli-js (2.8.0 or later)
Vendor Advisory: https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516
Restart Required: Yes
Instructions:
1. Update package.json to use docker-cli-js version 2.8.0 or later. 2. Run 'npm update docker-cli-js' or 'yarn upgrade docker-cli-js'. 3. Restart your application to load the updated package.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for any user input that reaches Docker.command method
// JavaScript example: Validate and sanitize user input
const userInput = sanitizeInput(req.body.command);
// Use allowlist approach for valid commands only
Remove docker-cli-js Dependency
allReplace docker-cli-js with alternative Docker client libraries that don't have this vulnerability
npm uninstall docker-cli-js
npm install dockerode
// Or use Docker's official SDK
🧯 If You Can't Patch
- Implement strict input validation using allowlists for allowed Docker commands only
- Run application with minimal privileges and in isolated containers to limit blast radius
🔍 How to Verify
Check if Vulnerable:
Check package.json for docker-cli-js version. If version is below 2.8.0 and application passes user input to Docker.command method, it's vulnerable.Check Version:
npm list docker-cli-js | grep docker-cli-jsVerify Fix Applied:
Verify docker-cli-js version is 2.8.0 or higher in package.json and node_modules. Test that command injection attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual Docker commands in application logs
- Shell command execution patterns in system logs
- Failed command injection attempts in error logs
Network Indicators:
- Unexpected outbound connections from application to external IPs
- Unusual Docker API traffic patterns
SIEM Query:
source="application.logs" AND "docker-cli-js" AND ("|" OR ";" OR "$" OR "`")