19% of the most popular Docker images lack a password for root

Last Saturday, May 18, Jerry Gamblin from Kenna Security reviewed the 1000 most popular images from Docker Hub for the password used for the root user. In 19% of cases, it was found to be empty.

Background on Alpine

The motivation for this mini-research was the Talos Vulnerability Report that appeared earlier this month (TALOS-2019-0782), authored by Peter Adkins from Cisco Umbrella, which reported that Docker images with the popular container distribution Alpine do not have a password for root:

"Official versions of Docker images of Alpine Linux (starting from v3.3) contain a NULL password for the root user. This vulnerability emerged from a regression introduced in December 2015. The essence of the issue is that systems deployed with problematic versions of Alpine Linux in a container and using Linux PAM or another mechanism relying on the system's shadow file as the authentication database may accept a NULL password for the root user."

The versions of Docker images with Alpine known to be problematic were from 3.3 to 3.9 inclusive, as well as the latest edge release.

The authors provided the following recommendation for affected users:

"The root account should be explicitly disabled in Docker images built on the problematic versions of Alpine. The likelihood of exploiting the vulnerability depends on the environment, as its success requires a service or application exposed externally that uses Linux PAM or another similar mechanism."

The problem was has been closed in Alpine versions 3.6.5, 3.7.3, 3.8.4, 3.9.2, and edge (20190228 snapshot), and users with affected images were advised to comment out the line with root in /etc/shadow or ensure the absence of the package linux-pam.

Continuation from Docker Hub

Jerry Gamblin decided to find out how widespread the practice of using null passwords in containers might be. For this, he wrote a small Bash script, the essence of which is quite simple:

• a curl request to the Docker Hub API retrieves a list of hosted Docker images;
• it is sorted by the field popularity, and from the results, the top thousand is selected;
• for each of them, a docker pull;
• for each retrieved Docker image from Docker Hub, the docker run is executed by reading the first line of the file; /etc/shadow;
• if the value of the line turns out to be root:::0:::::, the name of the image is saved to a separate file.

What did he find? In this file There were 194 entries with names of popular Docker images with Linux systems where the root user does not have a set password:

Some of the most well-known names in this list include govuk/governmentpaas, hashicorp, microsoft, monsanto, and mesosphere. The kylemanna/openvpn is the most popular container on the list, boasting over 10 million pulls.

However, it is important to note that this phenomenon does not in itself indicate a direct vulnerability in the security of the systems that use them: it all depends on how exactly they are applied. (see the comment from the Alpine case above). Yet the 'moral of the story' has been seen many times before: apparent simplicity often has a downside that must always be remembered and whose consequences must be considered in technology deployment scenarios.

P.S.

Also read in our blog:

• «Statistics on base operating systems in images on Docker Hub»;
• «Note: The topic of Docker security is perhaps one of the eternal issues in the modern IT world. Therefore, without further ado, we present the translation of another collection of relevant recommendations.»;
• «Vulnerability CVE-2019-5736 in runc, allowing root privileges on the host»;
• «Vulnerable Docker VM — a puzzle VM about Docker and pentesting».

Source: habr.com