{"id":93156,"date":"2020-09-03T19:42:00","date_gmt":"2020-09-03T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov"},"modified":"2020-09-03T19:42:00","modified_gmt":"2020-09-03T17:42:00","slug":"uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","title":{"rendered":"Vuln\u00e9rabilit\u00e9s dans les scanners de s\u00e9curit\u00e9 des images de conteneurs Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publi\u00e9<\/a><\/noindex> les r\u00e9sultats des tests des outils de d\u00e9tection des vuln\u00e9rabilit\u00e9s non corrig\u00e9es et des probl\u00e8mes de s\u00e9curit\u00e9 dans les images de conteneurs Docker isol\u00e9s. Le contr\u00f4le a r\u00e9v\u00e9l\u00e9 que dans 4 des 6 scanners d'images Docker connus, des vuln\u00e9rabilit\u00e9s critiques permettaient d'attaquer directement le scanner lui-m\u00eame et d'ex\u00e9cuter son propre code dans le syst\u00e8me, dans certains cas (comme avec Snyk) avec des privil\u00e8ges root. <\/p>\n

Pour l'attaque, un attaquant n'a besoin que d'initier la v\u00e9rification de son Dockerfile ou manifest.json, incluant des m\u00e9tadonn\u00e9es sp\u00e9cialement con\u00e7ues, ou de placer des fichiers Podfile et gradlew \u00e0 l'int\u00e9rieur de l'image. Des prototypes d'exploits ont \u00e9t\u00e9 pr\u00e9par\u00e9s<\/a><\/noindex> pour les syst\u00e8mes
\nWhiteSource<\/a><\/noindex>, Snyk<\/a><\/noindex>,
\nFossa<\/a><\/noindex> et
\nAnchore<\/a><\/noindex>. Le meilleur niveau de s\u00e9curit\u00e9 a \u00e9t\u00e9 observ\u00e9 avec le paquet Clair<\/a><\/noindex>, initialement \u00e9crit avec une attention particuli\u00e8re \u00e0 la s\u00e9curit\u00e9. Aucun probl\u00e8me n'a \u00e9galement \u00e9t\u00e9 identifi\u00e9 dans le paquet Trivy<\/a><\/noindex>. En conclusion, il a \u00e9t\u00e9 \u00e9tabli que les scanners de conteneurs Docker doivent \u00eatre ex\u00e9cut\u00e9s dans des environnements isol\u00e9s ou utilis\u00e9s uniquement pour v\u00e9rifier ses propres images, et il faut \u00e9galement faire preuve de prudence lors de la connexion de tels outils aux syst\u00e8mes d'int\u00e9gration continue automatis\u00e9s.<\/p>\n

Dans FOSSA, Snyk et WhiteSource, la vuln\u00e9rabilit\u00e9 \u00e9tait li\u00e9e \u00e0 l'appel d'un gestionnaire de paquets externe pour d\u00e9terminer les d\u00e9pendances, et permettait d'ex\u00e9cuter son propre code en indiquant les commandes touch et system dans les fichiers gradlew<\/a><\/noindex> et Podfile<\/a><\/noindex>.<\/p>\n

Dans Snyk et WhiteSource, de plus ont \u00e9t\u00e9 trouv\u00e9s<\/a><\/noindex> une vuln\u00e9rabilit\u00e9<\/a><\/noindex>, li\u00e9s<\/a><\/noindex> avec l'organisation du lancement de commandes syst\u00e8me lors de l'analyse du Dockerfile (par exemple, dans Snyk, il \u00e9tait possible de remplacer l'outil \/bin\/ls appel\u00e9 par le scanner, tandis que dans WhiteSource, il \u00e9tait possible d'ins\u00e9rer du code via des arguments sous la forme \u00ab echo ' ;touch \/tmp\/hacked_whitesource_pip;=1.0' \u00bb). <\/p>\n

Dans Anchore, la vuln\u00e9rabilit\u00e9 \u00e9tait caus\u00e9e par<\/a><\/noindex> l'utilisation de l'outil skopeo<\/a><\/noindex> pour travailler avec des images Docker. L'exploitation se r\u00e9sumait \u00e0 ajouter dans le fichier manifest.json des param\u00e8tres du type '\"os\": \"$(touch hacked_anchore)\"', qui sont ins\u00e9r\u00e9s lors de l'appel de skopeo sans un \u00e9chappement correct (seules les caract\u00e8res '\";\"&\"' \u00e9taient supprim\u00e9s, mais la construction '\"$()\"' \u00e9tait autoris\u00e9e).<\/p>\n

Le m\u00eame auteur a men\u00e9 une \u00e9tude sur l'efficacit\u00e9 de la d\u00e9tection des vuln\u00e9rabilit\u00e9s non corrig\u00e9es par les scanners de s\u00e9curit\u00e9 des conteneurs docker et le niveau de faux positifs (partie 1<\/a><\/noindex>, partie 2<\/a><\/noindex>, partie 3<\/a><\/noindex>). Les r\u00e9sultats des tests de 73 images, contenant des vuln\u00e9rabilit\u00e9s connues, sont pr\u00e9sent\u00e9s ci-dessous, ainsi qu'une \u00e9valuation de l'efficacit\u00e9 de la d\u00e9tection des applications standards dans les images (nginx, tomcat, haproxy, gunicorn, redis, ruby, node).<\/p>\n

\"Vuln\u00e9rabilit\u00e9s<\/a><\/noindex><\/center><\/p>\n

\"Vuln\u00e9rabilit\u00e9s<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker. \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430, \u0447\u0442\u043e \u0432 4 \u0438\u0437 6 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0430\u043c \u0441\u043a\u0430\u043d\u0435\u0440 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 Snyk) \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93157,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9s des scanners de s\u00e9curit\u00e9 des images des conteneurs Docker | ProHoster","description":"Les r\u00e9sultats des tests des outils de d\u00e9tection sont publi\u00e9s.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T17:42:00+00:00","article:modified_time":"2020-09-03T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93156","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:00","updated":"2022-10-01 01:38:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/93156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=93156"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/93156\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/93157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=93156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=93156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=93156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}