Well, That Escalated Quickly! How Abusing Docker API Led to Remote Code Execution, Same Origin Bypass and Persistence in the Hypervisor via Shadow Containers

Explore a Black Hat conference talk that delves into the security vulnerabilities of Docker API and their potential for exploitation. Learn how abusing Docker API can lead to remote code execution, same-origin policy bypass, and persistence in hypervisors through shadow containers. Discover the risks associated with containerization technology, particularly in development environments. Examine attack vectors targeting Windows 10 and Docker for Windows/Mac, including browser security implications and Same Origin Policy violations. Investigate techniques such as reverse shell demonstrations, DNS rebinding, and host rebinding. Uncover advanced persistent threats like shadow containers and their potential for creating concealed, persistent access. Gain insights into mitigation strategies and understand the broader implications for container security in modern development practices.