Anchore Engine 0.7.0 Container Image Manifest API Request process control

Summaryinfo

A vulnerability labeled as critical has been found in Anchore Engine 0.7.0. This vulnerability affects unknown code of the component Container Image Manifest Handler. Executing a manipulation as part of API Request can lead to process control. This vulnerability is registered as CVE-2020-11075. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as critical was found in Anchore Engine 0.7.0. This vulnerability affects an unknown part of the component Container Image Manifest Handler. The manipulation as part of a API Request leads to a process control vulnerability. The CWE definition for the vulnerability is CWE-114. Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.

The weakness was published 05/27/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability was named CVE-2020-11075 since 03/30/2020. The exploitation appears to be difficult. The attack can be initiated remotely. A single authentication is necessary for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Anchore Engine

Version

• 0.7.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion