cve/2021/CVE-2021-32635.md

### [CVE-2021-32635](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32635)
![](https://img.shields.io/static/v1?label=Product&message=singularity&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%20Improper%20Input%20Validation&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-923%3A%20Improper%20Restriction%20of%20Communication%20Channel%20to%20Intended%20Endpoints&color=brighgreen)

### Description

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container. Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint. The vulnerability is patched in Singularity version 3.7.4. Two possible workarounds exist: Users can only interact with the default remote endpoint, or an installation can have an execution control list configured to restrict execution to containers signed with specific secure keys.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/EGI-Federation/SVG-advisories