| Título | moto 5.2.4.dev Execution with Unnecessary Privileges |
|---|
| Descrição | A critical vulnerability has been identified in the moto library (PyPI), specifically in the AWS Batch emulation component located in moto/batch/models.py. The moto library is a widely used Python package that mocks AWS services for testing purposes. When moto is run in server mode (moto_server), it exposes an HTTP endpoint that accepts AWS API calls. The vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution with root privileges on the host machine running moto_server by exploiting the Batch service emulation.
The root cause is that moto's Batch implementation forwards container parameters from the RegisterJobDefinition API call directly to the local Docker daemon without applying any of the security constraints that real AWS Batch enforces. Two specific parameters are passed through without validation. First, the privileged flag in containerProperties is read from the attacker-supplied job definition and forwarded verbatim to Docker. Second, the volumes list, which can contain host.sourcePath entries pointing to arbitrary host filesystem paths, is used to construct docker.types.Mount objects with attacker-chosen source paths and read-only flags, and these mounts are applied to the container without any allowlist or path validation. Real AWS Batch explicitly rejects both of these parameters. Additionally, moto injects the MOTO_HOST and MOTO_HTTP_ENDPOINT environment variables into every spawned container, enabling lateral movement to the unauthenticated /moto-api/ administrative endpoints from inside the container. The affected code is approximately lines 827 through 932 in moto/batch/models.py, verified on version 5.2.4.dev.
The attack requires no authentication. By default, moto_server binds to x.x.x.x on port 3000 and authentication is disabled. An attacker creates the minimal AWS resources moto requires using unauthenticated boto3 calls, then calls RegisterJobDefinition with privileged set to true and a volumes entry whose host.sourcePath points to the host root. A SubmitJob call causes moto to start a container with --privileged and a read-write bind mount of the host root at /host. The attacker's command runs as root with full access to all host files and devices.
The impact is complete host compromise: read any file including /etc/shadow and SSH keys, write to any file including /etc/passwd and authorized_keys, access host block devices via the disk group, and escape the container via namespace manipulation. In CI/CD environments this enables supply chain attacks. On developer laptops it enables lateral movement into corporate infrastructure.
The CVSS 3.1 base score is 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attack vector is Network, complexity is Low, no privileges or user interaction required, and all three impact dimensions are High. The CVSS 4.0 base score is 9.3 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
Remediation should strip the dangerous parameters before they reach Docker — reject privileged:true, host.sourcePath volumes, and host-referencing mountPoints, none of which are permitted by real AWS Batch. Real container execution should be gated behind an opt-in environment variable (MOTO_BATCH_RUN_CONTAINERS=true) disabled by default. moto_server should bind to 127.0.0.1 by default. MOTO_HOST injection into containers should be removed or gated behind the same opt-in. |
|---|
| Fonte | ⚠️ https://drive.google.com/file/d/1EnXEWD-kBQLwRqpLoJPhtixywWumE0Br/view?usp=sharing |
|---|
| Utilizador | HAMZAOUI Mohamed (UID 91388) |
|---|
| Submissão | 14/10/2026 17h05 (há 25 dias) |
|---|
| Moderação | 08/11/2026 09h04 (25 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 432806 [Tidelift moto até 5.2.4 AWS Batch Emulation moto/batch/models.py privileged/volumes Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|