CVE-2024-33661
📋 TL;DR
CVE-2024-33661 is a URL redirection vulnerability in Portainer before version 2.20.0, allowing attackers to redirect users to malicious sites when the target is not index.yaml. This affects all users running vulnerable Portainer instances, potentially leading to phishing or further exploitation. The vulnerability stems from improper validation of redirect URLs.
💻 Affected Systems
- Portainer
📦 What is this software?
Portainer by Portainer
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect authenticated users to malicious sites, leading to credential theft, malware installation, or session hijacking, potentially compromising the entire container management environment.
Likely Case
Most probable impact is phishing attacks where users are tricked into entering credentials on fake login pages, resulting in unauthorized access to Portainer.
If Mitigated
With proper network segmentation and user awareness, impact is limited to isolated incidents with minimal data exposure.
🎯 Exploit Status
Exploitation requires user interaction (e.g., clicking a link), but technical complexity is low based on the CWE-601 description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.20.0
Vendor Advisory: https://github.com/portainer/portainer/compare/2.19.4...2.20.0
Restart Required: Yes
Instructions:
1. Backup your Portainer data. 2. Update Portainer to version 2.20.0 or later using your deployment method (e.g., Docker pull portainer/portainer:2.20.0). 3. Restart the Portainer service to apply the patch.
🔧 Temporary Workarounds
Restrict Network Access
linuxLimit access to Portainer to trusted IP addresses only, reducing exposure to potential attackers.
Use firewall rules: e.g., iptables -A INPUT -p tcp --dport 9000 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP
🧯 If You Can't Patch
- Implement strict user access controls and monitor for suspicious redirect activities.
- Use web application firewalls (WAF) to block malicious URL patterns and redirect attempts.
🔍 How to Verify
Check if Vulnerable:
Check the Portainer version via the web UI or API; if version is below 2.20.0, it is vulnerable.Check Version:
docker exec portainer portainer --version or check the web UI dashboard.Verify Fix Applied:
After updating, confirm the version is 2.20.0 or higher and test that redirects to non-index.yaml targets are blocked.📡 Detection & Monitoring
Log Indicators:
- Look for logs showing redirect attempts to unusual domains or URLs not matching index.yaml patterns.
Network Indicators:
- Monitor for HTTP 3xx redirect responses from Portainer to external or suspicious domains.
SIEM Query:
Example: source="portainer.log" AND (http_status=3* AND url NOT LIKE "*index.yaml*")🔗 References
- https://github.com/portainer/portainer/compare/2.19.4...2.20.0
- https://github.com/portainer/portainer/pull/11233
- https://github.com/portainer/portainer/pull/11236
- https://www.portainer.io/
- https://github.com/portainer/portainer/compare/2.19.4...2.20.0
- https://github.com/portainer/portainer/pull/11233
- https://github.com/portainer/portainer/pull/11236
- https://www.portainer.io/
