Results of testing tools for identifying unpatched vulnerabilities and detecting security issues in Docker container images. The check revealed that 4 out of 6 known Docker image scanners contained critical vulnerabilities that allow direct attacks on the scanner itself, enabling execution of the attacker's code on the system, in some cases (e.g., with Snyk) gaining root privileges.
To launch an attack, an attacker only needs to initiate a scan of their Dockerfile or manifest.json, which includes specially crafted metadata, or to place Podfile and gradlew files inside the image. Prototypes of exploits for systems
, ,
and
. The best security was demonstrated by the package , originally written with security in mind. No issues were found in the package . As a result, it was concluded that Docker container scanners should be run in isolated environments or used only for checking one’s own images, while also exercising caution when connecting such tools to automated continuous integration systems.
In FOSSA, Snyk, and WhiteSource, the vulnerability was linked to calling an external package manager to determine dependencies, allowing for execution of the attacker's code by specifying touch and system commands in the files and .
In Snyk and WhiteSource, additional , with the execution of system commands when parsing Dockerfile (for example, in Snyk, the utility /bin/ls called by the scanner could be replaced through the Dockerfile, and in WhiteSource, code could be injected through arguments in the form of ‘echo ‘;touch /tmp/hacked_whitesource_pip;=1.0’).
In Anchore, the vulnerability the use of the utility for working with Docker images. Exploitation involved adding parameters like ‘"os": "$(touch hacked_anchore)"’ to the manifest.json file, which were substituted during the call to skopeo without proper escaping (only characters such as ‘;&’ were stripped, but the construction ‘$()’ was allowed).
The same author conducted a study on the effectiveness of detecting unpatched vulnerabilities with Docker container security scanners and the level of false positives (, , ). Below are the test results of 73 images containing known vulnerabilities, as well as an assessment of the effectiveness of detecting standard applications in the images (nginx, tomcat, haproxy, gunicorn, redis, ruby, node).
Source: opennet.ru
