Description
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dromara | Jpom | ≤ 2.11.12 | — |
References
- https://github.com/dromara/Jpom/issues/119 issue-tracking
- https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28 patch
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51 technical-description
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51 technical-description
- VulnCheck Advisory: Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers third-party-advisory