Komodo Periphery agent flaw enables root RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Komodo's Periphery agent (≤2.2.0) lets authenticated non-admin users inject OS commands via container names, gaining root on managed servers.
CERT/CC published VU#456950 describing an OS command injection vulnerability in Periphery, the agent component of the open-source Komodo server/Docker management platform maintained by mogh.tech. Versions 2.2.0 and earlier fail to validate or sanitize user-supplied Docker container names before interpolating them into shell commands executed via sh -c. Two code paths are affected: container destruction (DestroyContainer/RemoveContainer) and container log search (SearchContainerLog/GetContainerLogSearch).
Because Periphery runs with root privileges on the host and has access to the Docker socket, an authenticated non-admin user able to supply or influence a container name can escape the intended command context and execute arbitrary commands as root on the underlying server. This provides a path to full host compromise, persistence, and lateral movement across a Komodo-managed fleet of Docker hosts — effectively a privilege escalation from a low-privileged Komodo account to root on managed infrastructure.
Komodo's maintainers coordinated with the reporter and CERT/CC and have shipped a fix in version 2.3.0. There is no indication in this advisory of in-the-wild exploitation; this is disclosure of a patched vulnerability. Defenders running self-hosted Komodo/Periphery deployments should upgrade to 2.3.0 or later immediately, audit Komodo user permissions (especially non-admin accounts that can trigger container destroy/log-search operations), and review Periphery/host logs for anomalous shell command execution or unexpected container name values containing shell metacharacters.
Detection guidance
Komodo Periphery Shell Spawn With Metacharacters in Docker Container Command
Periphery spawning sh/bash -c with a docker rm/logs command containing shell metacharacters (;, $(, backtick), consistent with container-name command injection (VU#456950). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Komodo Periphery Shell Spawn With Metacharacters in Docker Container Command
id: dd253585-65df-5eb8-b0f4-09d1dadc6cc2
status: experimental
description: Detects the Komodo Periphery agent launching a shell whose docker container
remove or log command line carries shell metacharacters such as semicolons, command
substitution or backticks. This matches OS command injection through an unsanitised
container name (CERT/CC VU#456950, Periphery 2.2.0 and earlier). Legitimate container
names do not contain these characters.
tags:
- attack.execution
- attack.t1059
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /periphery
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_docker:
CommandLine|contains:
- docker rm
- docker container rm
- docker logs
- docker container logs
selection_meta:
CommandLine|contains:
- ;
- $(
- '`'
condition: selection_parent and selection_shell and selection_docker and selection_meta
falsepositives:
- Custom Komodo log-search terms or wrapper scripts that legitimately chain commands
with a semicolon
level: high
author: Vorant
references:
- https://kb.cert.org/vuls/id/456950
Suspicious Tool Spawned by Shell Running Docker Command With Injected Metacharacters
A shell whose command line is a docker command with metacharacters spawns recon, download or reverse-shell tooling, indicating injected commands running as root via Periphery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Tool Spawned by Shell Running Docker Command With Injected Metacharacters
id: f43e3e02-441e-50d8-841c-2882c8e5c01b
status: experimental
description: Detects tools commonly used after command injection (recon, downloaders,
netcat, scripting interpreters) spawned by an sh/bash parent whose command line
is a docker command containing shell metacharacters. This is the pattern left when
a malicious container name breaks out of a docker rm or docker logs invocation,
as in the Komodo Periphery flaw (VU#456950).
tags:
- attack.execution
- attack.t1059
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /sh
- /bash
- /dash
selection_parentcmd:
ParentCommandLine|contains: docker
selection_meta:
ParentCommandLine|contains:
- ;
- $(
- '`'
selection_child:
Image|endswith:
- /curl
- /wget
- /nc
- /ncat
- /socat
- /id
- /whoami
- /python
- /python3
- /perl
- /useradd
- /chmod
condition: selection_parent and selection_parentcmd and selection_meta and selection_child
falsepositives:
- Administrator maintenance scripts that chain docker commands with curl or chmod
in a single sh -c string
level: high
author: Vorant
references:
- https://kb.cert.org/vuls/id/456950
Komodo Periphery Spawning Host Namespace Escape Tooling
Periphery directly executing nsenter or chroot, or a privileged docker run mounting the host root, suggesting escape to the host or abuse of the Docker socket as root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Komodo Periphery Spawning Host Namespace Escape Tooling
id: f3e86c7c-f1d8-55d8-a8b9-c876824b4e88
status: experimental
description: Detects the Komodo Periphery agent, which runs as root with Docker socket
access, launching nsenter or chroot, or starting a privileged docker container with
the host root filesystem mounted. These are host-escape primitives that fall outside
normal Periphery container management.
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /periphery
selection_escape_bin:
Image|endswith:
- /nsenter
- /chroot
selection_priv_docker:
CommandLine|contains|all:
- docker run
- --privileged
selection_hostmount:
CommandLine|contains:
- ' -v /:/'
- --volume /:/
- source=/,
condition: selection_parent and (selection_escape_bin or (selection_priv_docker
and selection_hostmount))
falsepositives:
- Administrators deliberately deploying privileged maintenance containers through
Komodo
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/456950
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/456950
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs