# GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection

GitLab-Runner on Windows docker executor executes arbitrary programs via path traversal in DOCKER_AUTH_CONFIG credHelpers, compromising the container host.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: ajxchapman
- Disclosed: 2020-11-04
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/955016
- Library page: https://bugbountylibrary.com/r/h1%3A955016
- Tags: area:cloud domain:infra impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:docker tech:go technique:chained technique:source-review vuln:command-injection vuln:path-traversal

**Target:** GitLab-Runner docker executor on Windows
**Root cause:** DOCKER_AUTH_CONFIG credHelpers values are passed unsanitized to docker's NewNativeStore, which prepends 'docker-credential-' and execs the result; Windows path normalization resolves traversal sequences, allowing arbitrary program execution.
**Steps:**
1. Register a Windows runner with docker executor tagged `windows-docker-runner`.
2. Create `.gitlab-ci.yml` with a `services` entry and `DOCKER_AUTH_CONFIG: "{\"credHelpers\" : {\"repo.example.com\" : \"/../../../../../../../../Windows/System32/calc.exe\"}}"`.
3. Tag build job with `windows-docker-runner` and run pipeline.
4. Runner processes DOCKER_AUTH_CONFIG and execs `docker-credential-/../../../../../../../../Windows/System32/calc.exe`, resolving to calc.exe on host.
5. For arbitrary payload: use a service to drop an exe into the predictable `C:\Builds` volume path and set credHelper to that full path.
**How found:** Code reading of docker CLI's NewNativeStore showing the 'docker-credential-' prefix, then reasoning that Windows path normalization ignores nonexistent directories, enabling traversal past the prefix.
**Exploitation:** Attacker with pipeline author rights sets DOCKER_AUTH_CONFIG credHelpers to a traversal path pointing at any host executable (or a payload dropped via a service container into the predictable volume mount). Runner execs it on the container host when creating the build container, compromising the host and all future builds.
**Escalation:** Chained with predictable per-build volume mount paths and service-container ordering to drop and execute an arbitrary payload rather than only existing binaries.
**Insight:** When a security control relies on a fixed string prefix to constrain an exec'd binary, test it on Windows: path normalization collapses `prefix/../../..` because the prefix directory need not exist, unlike *nix.