T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/deploy-agent.sh:122- Finding
Untrusted Docker Compose Files Can Request Host-Level Privileges
- Content
View full analysis
/dev/null || true docker compose -f "$compose_file" -p "$name" up -d --build 2>&1 | while IFS= read -r line; do echo " $line"; done local status=${PIPESTATUS[0]} ``` ### Technical Analysis The deployment workflow automatically discovers and executes a project-controlled Docker Compose file. It does not inspect the resolved Compose configuration, enforce a security policy, or ask the user to approve requested privileges. A Compose file can request security-sensitive Docker capabilities, including: - `privileged: true` - Host PID, IPC, or network namespaces - Arbitrary Linux capabilities - Host devices - Bind mounts of `/`, `/etc`, user home directories, or other sensitive paths - A bind mount of `/var/run/docker.sock` - Changes to seccomp or AppArmor protections Because the documented workflow explicitly supports uploaded or otherwise externally supplied projects, an attacker-controlled project can place these directives in a Compose file. Docker daemon access is effectively host-administrative in many environments, so merely placing the workload inside a container does not establish an adequate security boundary. ### Attack Path 1. An attacker supplies a project containing `compose.yml` or another supported Compose filename. 2. The Compose file defines a service with a dangerous setting, such as `privileged: true`, a mount of the ho ...[truncated 967 chars]- Remediation
View remediation