CVE-2021-23732 Arbitrary Code Execution
Attackers can execute arbitrary OS commands on the host if they control the command parameter in the Docker.command method.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23732?
CVE-2021-23732 is a critical command injection vulnerability in docker-cli-js, published on 22 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.
Weakness: CWE-78
Which versions are affected by CVE-2021-23732?
It affects 1 product.
Products include Quobject Docker-Cli-Js.
How do I fix CVE-2021-23732?
No fix has been published for CVE-2021-23732 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-23732 being exploited?
There is no known exploitation of CVE-2021-23732 in the wild and no public exploit code.