GitHub Advisoryadvisory · Go
GHSA-vq59-5x26-h639 Authorization Bypass Through User-Controlled Key play-with-docker
MEDIUM
Official page ↗
- Aliases
- CVE-2023-28109
- Ecosystem
- Go
- Packages
- github.com/play-with-docker/play-with-docker
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-639
- Reviewed
- 2023-03-17
Affected packages
• Go github.com/play-with-docker/play-with-docker: <= 0.0.2 (no fix yet)
Description
Impact
Give that CORS configuration was not correct, an attacker could use play-with-docker.com as an example, set origin header in http request as evil-play-with-docker.com, it will be echo in response header, which successfully bypass the CORS policy and retrieves basic user information.
Patches
It has been fixed in lastest version, Please upgrade to latest version
Workarounds
No, users have to upgrade version.
Related
Alias · CVE (1)
- CVE-2023-28109 Play With Docker is a browser-based Docker playground. vulnerability
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://github.com/play-with-docker/play-with-docker/security/advisories/GHSA-vq59-5x26-h639 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-28109 advisory
- https://github.com/play-with-docker/play-with-docker/commit/ed82247c9ab7990ad76ec2bf1498c2b2830b6f1a web
- https://github.com/play-with-docker/play-with-docker package