CVE-2023-28109

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

P

lay With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configuration was not correct, an attacker could use `play-with-docker.com` as an example and set the origin header in an http request as `evil-play-with-docker.com`. The domain would echo in response header, which successfully bypassed the CORS policy and retrieved basic user information. This issue has been fixed in commit ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a. There are no known workarounds.

References

Link	Resource
https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a	Patch
https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639	Vendor Advisory
https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a	Patch
https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:play-with-docker:play_with_docker:0.0.1:::::go::
	cpe:2.3:a:play-with-docker:play_with_docker:0.0.2:::::go::

History

21 Nov 2024, 07:54

Type	Values Removed	Values Added
References	~~() https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a - Patch~~	() https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a - Patch
References	~~() https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639 - Vendor Advisory~~	() https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639 - Vendor Advisory

Information

Published : 2023-03-16 17:15

Updated : 2024-11-21 07:54

NVD link : CVE-2023-28109

Mitre link : CVE-2023-28109

CVE.ORG link : CVE-2023-28109

JSON object : View

Products Affected

play-with-docker

play_with_docker

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2023-28109", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-03-16T17:15:09.763", "references": [{"url": "https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking.\nBecause CORS configuration was not correct, an attacker could use `play-with-docker.com` as an example and set the origin header in an http request as `evil-play-with-docker.com`. The domain would echo in response header, which successfully bypassed the CORS policy and retrieved basic user information. This issue has been fixed in commit ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a. There are no known workarounds."}], "lastModified": "2024-11-21T07:54:25.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:play-with-docker:play_with_docker:0.0.1:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "39F1E076-60E4-4945-950B-F37607615D26"}, {"criteria": "cpe:2.3:a:play-with-docker:play_with_docker:0.0.2:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "9FAE59ED-5C29-48FB-80EB-56F66698D613"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}