Description (CNA)
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider endpoint while bypassing response masking. If a user completed the OAuth flow, the provider's access and refresh tokens could be returned unmasked to the sandbox, exposing host-managed credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Docker / Docker Sandboxes | affected 0.21.0 before 0.47.0 |
CWE
CWE-178
References
- https://docs.docker.com/ai/sandboxes/
- https://docs.docker.com/ai/sandboxes/configuration/credentials/#how-credential-injection-works
ADP enrichment
No English description supplied.
No references supplied.