CVE-2023-28109

Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configuration was not correct, an attacker could use `play-with-docker.com` as an example and set the origin header in an http request as `evil-play-with-docker.com`. The domain would echo in response header, which successfully bypassed the CORS policy and retrieved basic user information. This issue has been fixed in commit ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a. There are no known workarounds.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a	Patch
https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:play-with-docker:play_with_docker:0.0.1:::::go::
	cpe:2.3:a:play-with-docker:play_with_docker:0.0.2:::::go::

History

No history.

Information

Published : 2023-03-16 17:15

Updated : 2023-11-07 04:10

NVD link : CVE-2023-28109

Mitre link : CVE-2023-28109

CVE.ORG link : CVE-2023-28109

JSON object : View

Products Affected

play-with-docker

play_with_docker

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2023-28109", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-03-16T17:15:09.763", "references": [{"url": "https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking.\nBecause CORS configuration was not correct, an attacker could use `play-with-docker.com` as an example and set the origin header in an http request as `evil-play-with-docker.com`. The domain would echo in response header, which successfully bypassed the CORS policy and retrieved basic user information. This issue has been fixed in commit ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a. There are no known workarounds."}], "lastModified": "2023-11-07T04:10:24.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:play-with-docker:play_with_docker:0.0.1:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "39F1E076-60E4-4945-950B-F37607615D26"}, {"criteria": "cpe:2.3:a:play-with-docker:play_with_docker:0.0.2:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "9FAE59ED-5C29-48FB-80EB-56F66698D613"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}