CVE-2021-34079
📋 TL;DR
This CVE describes an OS command injection vulnerability in Mintzo Docker-Tester that allows attackers to execute arbitrary commands on the host system. Attackers can exploit this by crafting malicious docker-compose.yml files with shell metacharacters in the 'ports' entry. Anyone using Docker-Tester versions through 1.2.1 is affected.
💻 Affected Systems
- Mintzo Docker-Tester
📦 What is this software?
Docker Tester by Docker Tester Project
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the host system with root-level access, allowing installation of persistent backdoors, data exfiltration, and lateral movement to other systems.
Likely Case
Unauthorized command execution leading to container escape, privilege escalation, and potential data theft or system disruption.
If Mitigated
Limited impact with proper input validation and execution in isolated environments, potentially only affecting the Docker-Tester process.
🎯 Exploit Status
Exploitation requires providing a crafted docker-compose.yml file to Docker-Tester. No authentication is needed if the tool processes untrusted input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2 or later
Vendor Advisory: https://advisory.checkmarx.net/advisory/CX-2021-4786
Restart Required: No
Instructions:
1. Update Docker-Tester using npm: 'npm update docker-tester' 2. Verify version is 1.2.2 or higher: 'npm list docker-tester' 3. Replace any vulnerable versions in your projects.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for docker-compose.yml files before passing to Docker-Tester
# Validate YAML structure before processing
# Use safe YAML parsers with restricted features
# Implement allowlist for port specifications
Run in Restricted Environment
linuxExecute Docker-Tester in isolated containers or sandboxes with minimal privileges
docker run --read-only --cap-drop=ALL -v /safe/path:/data your-image
# Use Docker security options like no-new-privileges
🧯 If You Can't Patch
- Disable or remove Docker-Tester from production systems
- Implement strict access controls to prevent untrusted users from providing docker-compose.yml files
🔍 How to Verify
Check if Vulnerable:
Check Docker-Tester version: 'npm list docker-tester' and verify if version is 1.2.1 or earlierCheck Version:
npm list docker-tester | grep docker-testerVerify Fix Applied:
Confirm version is 1.2.2 or later: 'npm list docker-tester | grep docker-tester'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Docker-Tester process
- Suspicious shell commands in system logs following YAML processing
- Unexpected process spawns from Docker-Tester
Network Indicators:
- Unexpected outbound connections from systems running Docker-Tester
- Command and control traffic from compromised hosts
SIEM Query:
process_name:"node" AND process_args:"docker-tester" AND (process_args:";" OR process_args:"|" OR process_args:"&")