Arcane Template Privilege Escalation via Default Role

Executive Summary

This vulnerability affects Arcane versions before 2.0.0 due to improper authorization checks. Default user role accounts can create, modify, or delete compose templates, including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.

Useful 0 Not Useful 0

Detection Guidance

Check Arcane version with 'docker exec <container> arcane version' or inspect logs for unauthorized template operations. Monitor API endpoints POST /api/templates, PUT /api/templates/{id}, DELETE /api/templates/{id}, POST /api/templates/{id}/download, POST /api/templates/default for unexpected activity from non-admin users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with default user access could overwrite system templates or inject privileged container configurations. When an administrator deploys these templates, the malicious configurations execute with host-level privileges, potentially leading to full filesystem compromise or unauthorized data access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's access controls. Unauthorized privileged container execution may expose sensitive data, triggering compliance violations and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Arcane to version 2.0.0 or later immediately. If upgrading is not possible, restrict access to template endpoints via network policies or firewall rules. Review and audit all template modifications made by non-admin users.

Useful 0 Not Useful 0