CVE-2021-27886
📋 TL;DR
CVE-2021-27886 is a command injection vulnerability in rakibtg Docker Dashboard that allows attackers to execute arbitrary commands on the host system by injecting shell metacharacters in API requests. This affects users of the third-party Docker Dashboard web interface before February 28, 2021. Note this is not an official Docker, Inc. product.
💻 Affected Systems
- rakibtg Docker Dashboard
📦 What is this software?
Docker Dashboard by Docker Dashboard Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the host system, allowing attackers to execute arbitrary commands with the privileges of the Docker Dashboard process, potentially leading to full system takeover, data exfiltration, or lateral movement.
Likely Case
Remote code execution leading to container escape, privilege escalation, and unauthorized access to the underlying host system and other containers.
If Mitigated
Limited impact if proper network segmentation, least privilege principles, and input validation are implemented, though the vulnerability still presents significant risk.
🎯 Exploit Status
Exploitation requires access to the Docker Dashboard API endpoint. Public exploit code is available in Packet Storm Security references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 79cdc41809f2030fce21a1109898bd79e4190661 and later
Vendor Advisory: https://github.com/rakibtg/docker-web-gui/commit/79cdc41809f2030fce21a1109898bd79e4190661
Restart Required: Yes
Instructions:
1. Update to the latest version of Docker Dashboard from the official GitHub repository. 2. Apply the security patch from commit 79cdc41809f2030fce21a1109898bd79e4190661. 3. Restart the Docker Dashboard service.
🔧 Temporary Workarounds
Disable Terminal API Endpoint
allTemporarily disable the vulnerable terminal.js API endpoint until patching is possible
Modify backend/utilities/terminal.js to remove or disable command execution functionality
Network Access Control
linuxRestrict network access to Docker Dashboard to trusted IP addresses only
iptables -A INPUT -p tcp --dport [DASHBOARD_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [DASHBOARD_PORT] -j DROP
🧯 If You Can't Patch
- Immediately isolate the Docker Dashboard instance from production networks and internet access
- Implement strict network segmentation and firewall rules to limit access to authorized users only
🔍 How to Verify
Check if Vulnerable:
Check if Docker Dashboard version is older than the February 28, 2021 patch. Review the terminal.js file for proper input sanitization of the command parameter.Check Version:
Check the Docker Dashboard version in the application interface or review the git commit historyVerify Fix Applied:
Verify that commit 79cdc41809f2030fce21a1109898bd79e4190661 is applied in your installation. Test that shell metacharacters in API requests no longer execute arbitrary commands.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in Docker Dashboard logs
- API requests containing shell metacharacters (;, &, |, $, etc.) to terminal endpoints
- Unexpected process creation from the Docker Dashboard service
Network Indicators:
- Unusual outbound connections from the Docker Dashboard host
- Traffic to terminal-related API endpoints from unauthorized sources
SIEM Query:
source="docker-dashboard" AND (command="*;*" OR command="*&*" OR command="*|*" OR command="*$*" OR command="*`*")🔗 References
- http://packetstormsecurity.com/files/163416/Docker-Dashboard-Remote-Command-Execution.html
- https://github.com/rakibtg/docker-web-gui/commit/79cdc41809f2030fce21a1109898bd79e4190661
- https://github.com/rakibtg/docker-web-gui/issues/23
- https://www.docker.com/legal/trademark-guidelines
- http://packetstormsecurity.com/files/163416/Docker-Dashboard-Remote-Command-Execution.html
- https://github.com/rakibtg/docker-web-gui/commit/79cdc41809f2030fce21a1109898bd79e4190661
- https://github.com/rakibtg/docker-web-gui/issues/23
- https://www.docker.com/legal/trademark-guidelines
