External risk intelligence

Play With Docker Container Escape via Insecure Privileged Mode

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-34844

Play With Docker is a browser-based, public-facing web platform designed to allow users to interact with Docker containers online. As an internet-accessible service meant for remote experimentation and interaction, the attack surface is exposed directly to the public internet by design, making it a commonly internet-facing web application.

Play With Docker Project Play With Docker

before 0.0.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Play With Docker versions prior to 0.0.2 that could allow unauthorized access and control of the underlying system. This issue stems from an insecure use of elevated privileges within the Docker container environment, potentially enabling a complete escape from the container's confines. The primary concern is to confirm if our environment is exposed to this specific software and version.

Container escape flaw in a Docker environment.
Confirms the risk of unauthorized system access.
Verify use of affected software and versions.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerability by exploiting an exposed web interface that allows interaction with Docker containers. This interface, part of Play With Docker, can be accessed without authentication. If an attacker can leverage this access, they might trigger the vulnerability within the container's privileged mode. This could potentially allow the attacker to escape the container and gain broader access to the underlying system.

No authentication required for access.
Insecure privileged mode triggers escape.
Risk of container escape and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to escape a Docker container running an affected version of Play With Docker, potentially granting them elevated privileges on the host system when supported by the advisory. This exposure is possible due to an insecure CAP_SYS_ADMIN privileged mode.

Container escape to host system.
Insecure privileged mode allows access.
Host system compromise and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Systems utilizing Play With Docker, specifically versions prior to 0.0.2, require immediate attention from platform or application owners who manage containerized environments. The initial step involves confirming the presence and accessibility of these vulnerable instances, assessing their business criticality, and identifying the accountable team for remediation. Planning for mitigation should then proceed based on the identified risk and operational constraints.

Platform or application owners should lead remediation efforts.
Verify if the affected technology is internet-reachable.
Plan immediate mitigation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Play With Docker?

Play With Docker is a browser-based, public-facing web platform. Users leverage this service to conduct remote experiments and interact with Docker containers online without needing to set up local infrastructure.

What does CVE-2023-34844 mean for container security?

This vulnerability is classified as Improper Check for Certificate Revocation (CWE-273). In this context, it relates to an insecure configuration where a container is granted excessive 'CAP_SYS_ADMIN' privileges. This weakness allows a process inside the container to break through its isolation boundaries, resulting in a container escape.

How can an attacker trigger this container escape?

An attacker initiates the exploit by interacting with the exposed Play With Docker web interface. The vulnerability is triggered by the insecure privileged mode used by the container; it does not require the attacker to have existing authentication or specific user permissions to reach this stage.

Is my instance of Play With Docker at risk?

According to Halo Surface Signal, Play With Docker is designed as a public-facing platform, meaning the attack surface is exposed to the internet by design. If you are running a version earlier than 0.0.2, your instance is accessible and inherently vulnerable to this external threat.

How do I address this vulnerability?

Begin by identifying all running instances of the platform to confirm if you are using a version prior to 0.0.2. Once identified, evaluate the business context of those instances, assign the task to the relevant application owner, and prioritize updating the software to a secure version.

References

hacku.top/wl/?id=MACBtnorZyp6hC3E5bw2CqBAusuWoKe3

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.