CVE-2024-23652
Mobyproject
CVE-2024-23652 is a critical vulnerability in BuildKit that allows a malicious actor to delete files on the host system outside the container. This path traversal flaw arises from the improper handling of mountpoint cleanup in Dockerfiles, specifically when using RUN --mount. While the CVSS score is 9.1, the SOCRadar Vulnerability Risk Score (SVRS) of 79 indicates a near-critical risk, suggesting immediate attention is needed. Exploit code is readily available "In The Wild," increasing the urgency. Exploitation could lead to data loss or system compromise. Users should upgrade to BuildKit v0.12.5 or avoid using untrusted BuildKit frontends or Dockerfiles with the RUN --mount feature to mitigate this significant threat.
Description:
CVE-2024-23652 is a critical vulnerability in BuildKit, a toolkit for converting source code to build artifacts. It allows a malicious BuildKit frontend or Dockerfile using RUN --mount to trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. This vulnerability has a CVSS score of 10, indicating its severe impact. The SVRS score of 36 highlights the urgency of addressing this threat, as it falls below the critical threshold of 80.
Key Insights:
-
Host System Compromise: This vulnerability enables attackers to execute arbitrary code on the host system by exploiting the BuildKit frontend or Dockerfile. This could lead to complete system compromise, data theft, or disruption of critical services.
-
Wide Attack Surface: BuildKit is widely used in container build environments, making this vulnerability highly impactful. Attackers can target various systems and applications that rely on BuildKit for building container images.
-
Active Exploitation: There are reports of active exploitation of this vulnerability in the wild, indicating that attackers are actively targeting systems vulnerable to this attack.
-
CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding this vulnerability, urging organizations to take immediate action to mitigate the risk.
Mitigation Strategies:
-
Update BuildKit: Organizations should immediately update BuildKit to version 0.12.5 or later to address this vulnerability. This update includes a fix that prevents the exploitation of this issue.
-
Review BuildKit Frontends and Dockerfiles: Review all BuildKit frontends and Dockerfiles used in your organization to ensure they are from trusted sources and do not contain malicious code.
-
Implement Least Privilege: Enforce the principle of least privilege by restricting the permissions of users and processes to only what is necessary. This can help limit the impact of an attack if it occurs.
-
Monitor and Detect Suspicious Activity: Implement robust monitoring and detection mechanisms to identify and respond to suspicious activities related to this vulnerability. This can help organizations detect and mitigate attacks promptly.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.