Docker Sandbox Symlink Path Traversal Vulnerability

Executive Summary

Docker Sandboxes' sbx cp command does not properly restrict host-side paths within a shared workspace. A malicious sandbox can create or replace a symlink in the workspace, causing a later copy operation to either read a host file outside the workspace into the sandbox or write sandbox-controlled data to a host path outside the workspace using the invoking user's permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker within a sandbox to access or modify files on the host system outside the intended workspace. This may lead to unauthorized data exposure, data corruption, or privilege escalation depending on the user's permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if unauthorized data exposure or tampering occurs.

Useful 0 Not Useful 0

Mitigation Strategies

Update Docker Sandboxes to version 0.51.0 or later, which includes security enhancements blocking symbolic link escapes in mounted directories and improving workspace-copy protections.

Useful 0 Not Useful 0