Critical · published September 30, 2025
🚨 An open gateway exposes internal Docker containers for all to see! This vulnerability in Vasion Print allows attackers to access services without any authentication—just like leaving the front door wide open with a "Welcome" sign! 🔥 Think of it like a hotel where the lobby is fully accessible without a keycard, and anyone can wander in and check out the guest list. Without proper access controls, any unauthorized individual can poke around and potentially cause chaos. An attacker could enumerate all internal services and their versions, manipulate exposed APIs, and even escalate privileges or crash the entire appliance! This could lead to devastating information leaks or outages, making it critical to address immediately.
Think of it like a hotel where the lobby is fully accessible without a keycard, and anyone can wander in and check out the guest list. Without proper access controls, any unauthorized individual can poke around and potentially cause chaos. The exposed /meta endpoint reveals every micro-service container with no required access controls or authentication, allowing unauthenticated users to interact with internal services and execute potentially harmful requests.
An attacker could enumerate all internal services and their versions, manipulate exposed APIs, and even escalate privileges or crash the entire appliance! This could lead to devastating information leaks or outages, making it critical to address immediately. Update to Vasion Print version 22.0.1049 or later, and Application version 20.0.2786 or higher to close this critical hole. Additionally, implement network-level restrictions and robust access controls to secure your Docker containers. You've got this! With these steps, you'll lock down your Docker environment and protect your network efficiently! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| vasion/virtual_appliance_application | < 20.0.2786 | 20.0.2786 |
| vasion/virtual_appliance_host | < 22.0.1049 | 22.0.1049 |