Loading vulnerability…
OpenShift Builder Docker Build Path Traversal Command Injection
CVE-2024-7387 is a path-traversal vulnerability in OpenShift Builder. In builds using the Docker strategy, a malicious BuildConfig can use the secret destinationDir attribute to traverse paths and overwrite executable files within the privileged build container. This can result in command injection and execution of attacker-controlled commands on the OpenShift node hosting the builder container.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution on the OpenShift node running the privileged builder container. An attacker may escalate privileges from code execution in the build environment to compromise or take over the underlying node.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict untrusted users' ability to create or modify BuildConfig objects and to control secret destination directories. Avoid Docker-strategy builds for untrusted build definitions where feasible, and limit access to privileged build-container workloads.
Patch, then assume compromise.
Apply the relevant Red Hat OpenShift Container Platform security update containing the fix for CVE-2024-7387. OpenShift Container Platform 4.16.13 includes remediation for affected 4.16 deployments; administrators should upgrade through the applicable release channel and deploy the updated component images.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.