CVE-2024-24557

6.9 · MEDIUM

Published Feb 1, 2024 mobyproject CWE-345 EPSS 0.26% (17th pctl) CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

Overview

CVE-2024-24557 is a medium-severity vulnerability affecting mobyproject moby. It was published on February 1, 2024 and has a CVSS 3.1 base score of 6.9 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 6.9, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

Technical Description

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Remediation

Check the references section for vendor advisories and patches from mobyproject. Update moby to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
mobyproject	moby	>= 0, < 24.0.9	Affected

References

GitHub github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae GitHub github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc GitHub github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae GitHub github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc

Frequently Asked Questions

What is CVE-2024-24557?

CVE-2024-24557 is a medium-severity vulnerability affecting mobyproject moby. It was published on February 1, 2024 and has a CVSS 3.1 base score of 6.9 (MEDIUM).

How severe is CVE-2024-24557?

This vulnerability has a CVSS 3.1 base score of 6.9, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-24557?

How can CyberStrike help with CVE-2024-24557?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-24557 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719