Docker Sandbox Credential Forwarding Authentication Bypass

Executive Summary

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy only removed alternate credentials when their values matched known sentinel values. This allowed untrusted code in an authorized sandbox to supply an unrecognized credential in another supported authentication header, potentially authenticating requests to an attacker-controlled account and exposing data in the request.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to an authorized sandbox could exploit this to authenticate requests as another user, potentially accessing sensitive data included in those requests. This could lead to unauthorized data exposure or account takeover if the affected service relies on the credentials for access control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations using Docker Sandboxes may face compliance violations if sensitive data is exposed due to this flaw, potentially resulting in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Docker Sandboxes to the latest version to ensure the credential handling vulnerability is patched. Review sandbox network and filesystem policies in the Docker Admin Console to restrict untrusted code execution. Monitor Docker daemon logs for suspicious authentication attempts or unauthorized access patterns.

Useful 0 Not Useful 0