CVE-2024-4388: Chromium Docker Image Bypasses TLS Cert Validation via --ignore-certificate-errors

Vulnerability Summary: Chromium Ignores Certificate Errors, Rendering TLS Validation Ineffective Vulnerability Overview Chromium enables the parameter by default, causing TLS certificate validation to be completely bypassed. Attackers can exploit this vulnerability to perform Man-in-the-Middle (MITM) attacks by spoofing arbitrary HTTPS websites (e.g., ) and successfully passing browser validation, thereby stealing sensitive user information. This vulnerability originates from the hardcoded inclusion of this parameter in the startup script of the official Docker image , with no option provided to disable it. --- Scope of Impact Affected Versions: All Docker images based on (as of the release of CVE-2024-4388) Affected Component: Chromium browser (Docker container environment) CVSS Score: 7.1 / 10 (High Severity) Impact: All users running Chromium containers with default configurations, particularly in application scenarios relying on TLS-secured communication --- Remediation 1. Remove the Dangerous Parameter: Delete the parameter from the Chromium startup command. 2. Modify Dockerfile or Startup Script: - If using a custom Dockerfile, ensure it does not inherit or add this parameter. - If using the official image, override the default startup command. For example: 3. Verify the Fix: After starting the container, accessing should display a certificate error warning rather than loading automatically. > ⚠️ Note: Even after removing this parameter, ensure no other mechanisms within the container (such as proxies or network rules) bypass certificate validation. --- POC Code / Exploit Code 1. Launch a Vulnerable Chromium Container 2. Access a Spoofed Website Inside the Container (Without Certificate Validation) > In actual testing, an attacker can set up an HTTPS service for locally; Chromium will automatically trust its self-signed certificate. 3. Verify Vulnerability Existence (Via curl Test) 4. Verify Fix (Connection Should Be Rejected) --- Additional Notes This vulnerability has been assigned CVE-2024-4388. An official patch has been released; users are advised to upgrade to the latest stable version of the Chromium image. For environments where immediate upgrades are not possible, risks can be temporarily mitigated by customizing startup parameters. --- ✅ Recommended Action: Immediately audit all container deployments using , remove the parameter, and update to the latest image version.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-4388: Chromium Docker Image Bypasses TLS Cert Validation via --ignore-certificate-errors

More from this source