Dockerfile ntopng权限绕过（CVE-2021-28073）漏洞

环境

nDPI 
#https://github.com/ntop/nDPI/archive/refs/tags/3.4.tar.gz 
ntopng 
# https://github.com/ntop/ntopng/archive/2154003f683e6483d0f5bd23780581ba5668ef49.tar.gz
start.sh #启动文件
Dockerfile

Dockerfile

FROM ubuntu:18.04

ENV LANG=C.UTF-8
ENV DEBIAN_FRONTEND=noninteractive

RUN  sed -i s@/archive.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list
RUN  apt-get clean
ADD nDPI /nDPI
ADD ntopng /ntopng
ADD start.sh /start.sh

RUN set -ex \
    && apt-get update \
    && apt-get install -y --no-install-recommends -y ca-certificates wget rrdtool \
    && apt-get install -y redis-server --no-install-recommends -y build-essential git bison flex libxml2-dev libpcap-dev libtool libtool-bin librrd-dev autoconf pkg-config automake autogen redis-server libsqlite3-dev libhiredis-dev libmaxminddb-dev libcurl4-openssl-dev libpango1.0-dev libcairo2-dev libnetfilter-queue-dev zlib1g-dev libssl-dev libcap-dev libnetfilter-conntrack-dev libreadline-dev libjson-c-dev libldap2-dev rename libsnmp-dev libpng-dev libzmq5-dev default-libmysqlclient-dev --fix-missing
WORKDIR /
RUN cd /nDPI \
    && ./autogen.sh \
    && ./configure \
    && make \
    && cd /ntopng \
    && ./autogen.sh \
    && ./configure \
    && make \
    && make install \
    && apt-get purge -y --auto-remove build-essential git bison flex autoconf pkg-config automake autogen redis-server libtool libtool-bin \
    && apt-get -y install redis-server

RUN ["chmod", "+x", "start.sh"]
# CMD ["bash"]
EXPOSE 3000
ENTRYPOINT "/start.sh"

start.sh

#!/bin/bash
# start database
nohup redis-server >myoutfile1.log 2>&1 &
# start ntopng
# 后台运行服务
# nohup ntopng --http-port=0.0.0.0:3000 --redis=127.0.0.1:6379 >myoutfile.log 2>&1 &
ntopng --http-port=0.0.0.0:3000 --redis=127.0.0.1:6379