CVE-2024-8695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before version 4.34.2. This vulnerability is associated with improper neutralization of input during web page generation (Cross-site Scripting) and improper control of generation of code (Code Injection).
Impact
This vulnerability has a critical severity with a CVSS v4 base score of 9.0. If exploited, it could lead to high impacts on the vulnerable system's confidentiality, integrity, and availability. Additionally, it could have high impacts on subsequent systems' confidentiality, integrity, and availability. The attack vector is network-based, requiring high attack complexity and passive user interaction, but no privileges are required to execute the attack.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability affects Docker Desktop versions before 4.34.2, implying that upgrading to version 4.34.2 or later would mitigate this vulnerability.
Mitigation
1. Upgrade Docker Desktop to version 4.34.2 or later as soon as possible. 2. Implement strict input validation and sanitization for extension descriptions and changelogs. 3. Apply the principle of least privilege to limit the potential impact of successful exploits. 4. Regularly monitor and audit Docker Desktop extensions for suspicious activity. 5. Educate users about the risks of installing untrusted extensions. 6. Consider implementing additional security controls such as web application firewalls to help detect and prevent cross-site scripting and code injection attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
NVD published the first details for CVE-2024-8695
A CVSS base score of 9 has been assigned.
Feedly found the first article mentioning CVE-2024-8695. See article
Feedly estimated the CVSS score as HIGH
Detection for the vulnerability has been added to Qualys (380499)
EPSS Score was set to: 0.04% (Percentile: 9.6%)
A CVSS base score of 9.8 has been assigned.