CVE-2024-36587

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-36587 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 20, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

dnscrypt-proxy

Browse dnscrypt / dnscrypt-proxy

Default status: unknown

CVE Listv2.0.0alpha9 to ≤ v2.1.5affected

Proofs of concept

1

Repository PoCs

GitHubmeeeeing/CVE-2024-36587Repository PoCby meeeeing0Not analyzed6 files

1.5 MiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yaml

meeeeing/CVE-2024-36587Created Vuln labCVE-2024-36587Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds a container from Ubuntu 24.04, clones and builds dnscrypt-proxy v2.1.0, and plants a fake 'id' binary to demonstrate a local privilege escalation vulnerability (CVE-2024-36587).

Dockerfile:1-20docker-compose.yaml:1-9README.md:1-88

Lab assessment

Vulnerability lab

The README explicitly describes a CVE-2024-36587 proof-of-concept for dnscrypt-proxy local privilege escalation, and the Dockerfile and Compose file construct a target environment with a planted malicious binary to trigger the vulnerability.

README.md:1-5README.md:7-9Dockerfile:15-18
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

poc

vulnerable targetexploit demonstration container

A privileged container built from Ubuntu 24.04 that clones dnscrypt-proxy v2.1.0, builds it, and plants a fake 'id' script at /usr/local/bin/id. The CMD attempts to run the proxy with '-service install', which is the vulnerable action. The planted 'id' binary is the payload that demonstrates privilege escalation when executed.

Dockerfile:1-20docker-compose.yaml:1-9README.md:11-27
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-36587

Supported by supplied evidence

The README states the vulnerability is in dnscrypt-proxy v2.0.0-alpha9 to v2.1.5, and the Dockerfile checks out v2.1.0, which falls within the affected range. The PoC plants a fake 'id' binary to exploit the service install trust issue, matching the described binary planting method.

README.md:3-5Dockerfile:10-12Dockerfile:15-18
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:11-13
  • The container must be run with --privileged flag (as specified in docker-compose.yaml).docker-compose.yaml:6
  • The operator must build the image and then manually exec into the container to trigger the PoC.README.md:11-19

Evidence-described exercise path

  1. Build and start the container using 'docker compose up --build'.README.md:11-13
  2. Access the container shell with 'docker run -it --privileged dnscrypt-poc-poc bash'.README.md:17-19
  3. Inside the container, execute '/tmp/id' and verify the output 'Pwned_from_Docker' by reading '/tmp/poc_was_here'.README.md:23-27
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The planted 'id' binary only writes a harmless file inside the container. The privileged flag is a documented prerequisite for the PoC and does not perform any host compromise. No external network connections, host file modifications, or persistence mechanisms are observed.

Dockerfile:15-18docker-compose.yaml:6README.md:23-27
Review boundaries

What the analysis did not establish

  • The PoC_Report_CVE-2024-36587.pdf is uninspected and may contain additional details or instructions.
  • The CMD in the Dockerfile attempts to run './dnscrypt-proxy/proxy -service install', but the actual behavior of this command and its interaction with the planted binary is not fully detailed in the provided text.
  • The repository contains a .DS_Store file and a screenshot, which are not analyzed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

References

2