Docker UI 0.10.0 Cross Site Scripting

`  
Document Title:  
===============  
Docker UI v0.10.0 - Multiple Persistent Vulnerabilities  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1803  
  
  
Release Date:  
=============  
2016-03-29  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1803  
  
  
Common Vulnerability Scoring System:  
====================================  
3.7  
  
  
Product & Service Introduction:  
===============================  
DockerUI is a web interface for the Docker Remote API. The goal is to  
provide a pure client side implementation so it  
is effortless to connect and manage docker. This project is not complete  
and is still under heavy development.  
  
(Copy of the Vendor Homepage: https://hub.docker.com/r/dockerui/dockerui/ )  
  
  
Abstract Advisory Information:  
==============================  
An independent vulnerability laboratory researcher discovered multiple  
client-side cross site request forgery vulnerabilities in the official  
Docker UI web-application.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2016-03-29: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
Multiple persistent input validation web vulnerabilities has been  
discovered in the official Docker UI v0.10.0 web-application.  
The vulnerability allows remote attacker to inject own malicious script  
codes to the application-side of the vulnerable modules.  
  
The Repo is vulnerable to a stored XSS attack meaning that if one  
admin/normal repo user intentionally or via an attack implants  
an malicious script into the portal, the other users who logs in can be  
compromised and his/her account details can be used for  
performing malicious activities like deleting /stopping/ killing  
containers etc. Though there is no login mechanism currently  
for this UI, still this vulnerability can be used for exfiltrating data.  
  
Request Method(s):  
[+] POST  
  
Vulnerable Module(s):  
[+] ./volumes  
  
  
Proof of Concept (PoC):  
=======================  
The vulnerability can be exploited by remote attackers with low  
privileged web-application user account and without user interaction.  
For security demonstration or to reproduce the vulnerability follow the  
provided information and steps below to continue.  
  
PoC: Payload  
"><script>alert("dockerXSS");</script>  
  
  
Manual steps to reproduce the vulnerability ...  
1. Open the web-application  
2. login as basic user account  
3. Open volumes tab under Docker UI module  
4. Insert a script code payload as name/driver  
5. Click the create volume button to save the entry via POST  
6. The code executes directly in the webpage context of the list page  
Note: The network module mask is affected as well by the issue  
7. Successful reproduce of the vulnerability!  
  
  
Reference(s):  
http://127.0.0.1:9000/#/volumes  
  
  
Security Risk:  
==============  
The security risk of the persistent input validation web vulnerabilities  
are estimated as medium. (CVSS 3.7)  
  
  
Credits & Authors:  
==================  
Manideep K. - [http://www.vulnerability-lab.com/show.php?user=Manideep%20K.]  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without  
any warranty. Vulnerability Lab disclaims all warranties, either  
expressed or implied,  
including the warranties of merchantability and capability for a  
particular purpose. Vulnerability-Lab or its suppliers are not liable in  
any case of damage,  
including direct, indirect, incidental, consequential loss of business  
profits or special damages, even if Vulnerability-Lab or its suppliers  
have been advised  
of the possibility of such damages. Some states do not allow the  
exclusion or limitation of liability for consequential or incidental  
damages so the foregoing  
limitation may not apply. We do not approve or encourage anybody to  
break any licenses, policies, deface websites, hack into databases or  
trade with stolen data.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com   
- www.evolution-sec.com  
Contact: [email protected] -  
[email protected] - [email protected]  
Section: magazine.vulnerability-lab.com -  
vulnerability-lab.com/contact.php -  
evolution-sec.com/contact  
Social: twitter.com/vuln_lab -  
facebook.com/VulnerabilityLab -  
youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php -  
vulnerability-lab.com/rss/rss_upcoming.php -  
vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php -  
vulnerability-lab.com/list-of-bug-bounty-programs.php -  
vulnerability-lab.com/register.php  
  
Any modified copy or reproduction, including partially usages, of this  
file requires authorization from Vulnerability Laboratory. Permission to  
electronically  
redistribute this alert in its unmodified form is granted. All other  
rights, including the use of other media, are reserved by  
Vulnerability-Lab Research Team or  
its suppliers. All pictures, texts, advisories, source code, videos and  
other information on this website is trademark of vulnerability-lab team  
& the specific  
authors or managers. To record, list, modify, use or edit our material  
contact (admin@ or [email protected]) to get a ask permission.  
  
Copyright © 2016 | Vulnerability Laboratory -  
[Evolution Security GmbH]™  
  
  
  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com  
CONTACT: [email protected]  
  
`