Listen to this Post
The vulnerability exploits Arcane’s updater service lifecycle labels `com.getarcaneapp.arcane.lifecycle.pre-update` and com.getarcaneapp.arcane.lifecycle.post-update. These labels allow defining commands to run before or after a container update. The label value is passed directly to `/bin/sh -c` without any sanitization or validation. Any authenticated user, not just administrators, can create projects via the API. An attacker can create a project specifying one of these lifecycle labels with a malicious command. When an administrator triggers a container update manually or via scheduled checks, Arcane reads the lifecycle label and executes its value as a shell command inside the container. If the container uses host volume mounts in its Compose definition, the executed command can read from or write to the host filesystem through mounted paths. This enables data theft and, in configurations with mounts like /var/run/docker.sock, can lead to full host compromise. The attack leverages improper input handling and excessive privileges in project creation, allowing low-privilege users to inject commands that run with container privileges, potentially escalating to host access.
Platform: Arcane
Version: Updater service
Vulnerability: Command injection
Severity: Critical
date: Unknown
Prediction: Patch implemented
What Undercode Say:
Analytics:
curl -X POST -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -d '{"name":"malicious","labels":{"com.getarcaneapp.arcane.lifecycle.pre-update":"malicious_command"}}' http://arcane-api/projects
docker-compose -f /path/to/compose.yml up -d --force-recreate
echo 'malicious_command' > /host_mount/exploit
how Exploit:
Authenticated user creates project with malicious lifecycle label via API. Admin triggers container update, executing command. Host volume mounts enable host filesystem access.
Protection from this CVE:
Remove lifecycle labels. Restrict project creation privileges. Sanitize label inputs. Update Arcane immediately.
Impact:
Remote code execution. Host filesystem access. Data exfiltration. Full host compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
