New Docker 1-Click RCE Attack Exploits Misconfigured API Settings

A newly disclosed attack method targeting Docker installations has raised significant security concerns among developers and system administrators. The vulnerability leverages a misconfigured Docker Engine API setting, allowing attackers to achieve remote code execution (RCE) with minimal user interaction. While Docker’s default settings are secure, enabling specific configurations can leave systems critically exposed. The attack […] The post New Docker 1-Click RCE Attack Exploits Misconfigured API Settings appeared first on Cyber Security News.

Jan 28, 2025 - 08:45

New Docker 1-Click RCE Attack Exploits Misconfigured API Settings

A newly disclosed attack method targeting Docker installations has raised significant security concerns among developers and system administrators.

The vulnerability leverages a misconfigured Docker Engine API setting, allowing attackers to achieve remote code execution (RCE) with minimal user interaction. While Docker’s default settings are secure, enabling specific configurations can leave systems critically exposed.

The attack revolves around the Docker Engine API, a RESTful interface designed to manage containers, images, and networks. By default, this API is bound to the localhost and requires authentication.

However, if users enable the API on port 2375 without proper security measures, such as binding it to localhost only or requiring authentication, it becomes a potential entry point for attackers.

According to the researcher, this configuration exposes the API to unauthorized access, allowing malicious actors to create containers, execute commands, and even escalate privileges to the host machine.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN Sandox -> Try for Free

Historically, exposed Docker APIs have been exploited for cryptojacking and botnet deployments. This new attack method, however, introduces a novel “one-click” exploitation pathway that can be triggered via a web browser.

Docker 1-Click RCE Attack

The attack chain begins with a user visiting a malicious website while running a Docker instance with an exposed API on port 2375, reads the report.

The attacker bypasses Same-Origin Policy (SOP) restrictions using creative techniques such as HTML forms or JavaScript fetch() requests to interact with the Docker API.

Container Creation and Privilege Escalation:

The attacker sends a POST request to create a new container with elevated privileges.
Using the HostConfig option of the API, they bind the host filesystem (/:/mnt) to the container, granting read-write access to critical system files.

Command Execution:

Once the container is created, the attacker executes commands through additional API endpoints. For example, they could overwrite host files or create directories in sensitive locations.

Browser-Based Exploitation:

The most alarming aspect is the ability to trigger these actions from a browser. By embedding a specially crafted HTML form or script on a webpage, attackers can automate API calls when a victim visits their site.

Dockerfile Abuse:

The attack leverages the /build endpoint of the Docker API, which allows remote Dockerfile execution. By specifying parameters like networkmode=host, attackers can interact with the host’s localhost network from within a container.

Proof-of-Concept Exploit

A sample exploit involves creating a Dockerfile that mounts the host filesystem and executes commands to manipulate host files. The process is initiated by submitting an HTML form or running JavaScript code that interacts with the exposed API:

This simple interaction results in full control over the victim’s host system.

Docker has acknowledged this as an accepted risk for users who enable insecure configurations. To protect against such attacks:

Disable Remote API Access: Avoid exposing the Docker API on port 2375 or restrict it to trusted IP addresses.
Enable Authentication: Use TLS certificates or other authentication mechanisms for accessing the Docker API.
Monitor Network Activity: Regularly audit network traffic for unusual activity targeting port 2375.
Update Software: Ensure all Docker components are up-to-date with security patches.
Educate Users: Inform developers and administrators about secure configuration practices.

While this attack requires specific conditions, such as an exposed Docker API and user interaction, it highlights how misconfigurations can lead to severe vulnerabilities.

Developers are urged to review their Docker settings immediately and disable any unnecessary features that could expose their systems to exploitation.

Integrating Application Security into Your CI/CD Workflows Using Jenkins & Jira -> Free Webinar

The post New Docker 1-Click RCE Attack Exploits Misconfigured API Settings appeared first on Cyber Security News.