{"id":93156,"date":"2020-09-03T19:42:00","date_gmt":"2020-09-03T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov"},"modified":"2020-09-03T19:42:00","modified_gmt":"2020-09-03T17:42:00","slug":"uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","title":{"rendered":"Vulnerabilit\u00e0 negli scanner di sicurezza delle immagini dei container Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pubblicato<\/a><\/noindex> risultati dei test degli strumenti per l'identificazione delle vulnerabilit\u00e0 non corrette e per la rilevazione di problemi di sicurezza nelle immagini dei container Docker isolati. I controlli hanno mostrato che 4 su 6 dei noti scanner di immagini Docker presentavano vulnerabilit\u00e0 critiche, che consentono di attaccare direttamente lo scanner stesso e di eseguire codice sulla macchina, in alcuni casi (ad esempio, utilizzando Snyk) con diritti di root. <\/p>\n

Per effettuare l'attacco, \u00e8 sufficiente che l'attaccante inizi una verifica del proprio Dockerfile o di manifest.json, inclusi metadati appositamente formattati, o posizionare all'interno dell'immagine file Podfile e gradlew. Prototipi di exploit sono stati preparati<\/a><\/noindex> per sistemi
\nWhiteSource<\/a><\/noindex>, Snyk<\/a><\/noindex>,
\nFossa<\/a><\/noindex> e
\nAnchore<\/a><\/noindex>. Il pacchetto ha mostrato la migliore sicurezza Clair<\/a><\/noindex>, originariamente scritto tenendo in considerazione la sicurezza. Non sono stati riscontrati problemi nel pacchetto Trivy<\/a><\/noindex>. In conclusione, si raccomanda di eseguire gli scanner dei container Docker in ambienti isolati o di utilizzarli solo per controllare le proprie immagini, e di prestare attenzione quando si collegano tali strumenti a sistemi di integrazione continua automatizzati.<\/p>\n

In FOSSA, Snyk, and WhiteSource, the vulnerability was associated with the call to an external package manager to determine dependencies, allowing the execution of custom code through the specification of touch and system commands in files. gradlew<\/a><\/noindex> e Podfile<\/a><\/noindex>.<\/p>\n

In Snyk and WhiteSource, there were additional findings<\/a><\/noindex> vulnerabilit\u00e0<\/a><\/noindex>, relativi<\/a><\/noindex> con l'organizzazione dell'esecuzione dei comandi di sistema durante l'analisi del Dockerfile (ad esempio, in Snyk tramite Dockerfile era possibile sostituire l'utilit\u00e0 \/bin\/ls chiamata dallo scanner, mentre in WhiteSource era possibile inserire codice tramite argomenti nella forma \"echo ' ;touch \/tmp\/hacked_whitesource_pip;=1.0'\"). <\/p>\n

In Anchore, the vulnerability was caused by<\/a><\/noindex> the use of the utility skopeo<\/a><\/noindex> per lavorare con le immagini docker. L'exploitation consisteva nell'aggiunta al file manifest.json di parametri del tipo '\"os\": \"$(touch hacked_anchore)\"', che venivano inseriti durante la chiamata a skopeo senza la dovuta escapement (venivano rimossi solo i caratteri ';&', ma era consentita la costruzione '$(...)').<\/p>\n

The same author conducted a study on the effectiveness of detecting unpatched vulnerabilities by docker container security scanners and the level of false positives (parte 1<\/a><\/noindex>, parte 2<\/a><\/noindex>, parte 3<\/a><\/noindex>). Di seguito sono riportati i risultati dei test su 73 immagini contenenti vulnerabilit\u00e0 note, insieme a una valutazione dell'efficacia del rilevamento delle applicazioni standard nelle immagini (nginx, tomcat, haproxy, gunicorn, redis, ruby, node).<\/p>\n

\"Vulnerabilit\u00e0<\/a><\/noindex><\/center><\/p>\n

\"Vulnerabilit\u00e0<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker. \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430, \u0447\u0442\u043e \u0432 4 \u0438\u0437 6 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0430\u043c \u0441\u043a\u0430\u043d\u0435\u0440 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 Snyk) \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93157,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 negli scanner di sicurezza delle immagini dei contenitori Docker | ProHoster","description":"Sono stati pubblicati i risultati dei test degli strumenti di identificazione.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T17:42:00+00:00","article:modified_time":"2020-09-03T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93156","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:00","updated":"2022-10-01 01:38:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/93156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=93156"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/93156\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/93157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=93156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=93156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=93156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}