Jerry Gamblin decided to investigate how widespread the recently discovered in Docker images of the Alpine distribution related to the specification of an empty password for the root user. An analysis of a thousand of the most popular containers from the Docker Hub catalog , that among them (19.4%) a blank password is set for root without account locking ("root:::0:::::" instead of "root:!::0:::::").
In the case of using shadow and linux-pam packages in the container, the use of an empty root password can escalate privileges within the container if there is unprivileged access to the container or after exploiting a vulnerability in an unprivileged service running in the container. It is also possible to connect to the container with root privileges if there is access to the infrastructure, i.e., the ability to connect via terminal to the TTY specified in the /etc/securetty list. SSH access with an empty password is blocked.
The most popular among include , , , , and , which have over 10 million downloads. Additionally, the following containers are noted:
(500k), (5 million),
(1 million),
(5 million)
and (1 million). Almost all of these containers are based on Alpine and do not use shadow and linux-pam packages. The only exception is microsoft/azure-cli, which is based on Debian.
Source: opennet.ru
