Moby up to 24.0.8/25.0.1 /build origin validation

Summaryinfo

A vulnerability was found in Moby up to 24.0.8/25.0.1 and classified as problematic. Affected is an unknown function of the file /build. Executing a manipulation can lead to origin validation. This vulnerability is tracked as CVE-2024-24557. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Moby up to 24.0.8/25.0.1. It has been declared as problematic. This vulnerability affects an unknown code of the file /build. The manipulation with an unknown input leads to a origin validation vulnerability. The CWE definition for the vulnerability is CWE-346. The product does not properly verify that the source of data or communication is valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

The weakness was disclosed 02/01/2024 as GHSA-xw73-rw38-6vjc. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-24557 since 01/25/2024. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 242739 (NewStart CGSL MAIN 7.02 : docker-ce Vulnerability (NS-SA-2025-0150)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 24.0.9 or 25.0.2 eliminates this vulnerability. Applying the patch 3e230cfdcc989dc524882f6579f9e0dac77400ae is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (242739). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Moby

Version

• 24.0.0
• 24.0.1
• 24.0.2
• 24.0.3
• 24.0.4
• 24.0.5
• 24.0.6
• 24.0.7
• 24.0.8
• 25.0.0
• 25.0.1

License

• open-source

Website

• Product: https://github.com/moby/moby/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion