{"id":93156,"date":"2020-09-03T19:42:00","date_gmt":"2020-09-03T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov"},"modified":"2020-09-03T19:42:00","modified_gmt":"2020-09-03T17:42:00","slug":"uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een scanerele de securitate pentru imagini ale containerelor Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publicate<\/a><\/noindex> rezultatele test\u0103rii instrumentelor pentru identificarea vulnerabilit\u0103\u021bilor necorectate \u0219i depistarea problemelor de securitate \u00een imaginile containerelor Docker izolate. Verificarea a ar\u0103tat c\u0103 \u00een 4 din 6 scanere cunoscute de imagini Docker existau vulnerabilit\u0103\u021bi critice, care permiteau atacarea direct\u0103 a scannerului \u0219i executarea codului propriu \u00een sistem, \u00een unele cazuri (de exemplu, la utilizarea Snyk) cu drepturi de root. <\/p>\n

Pentru atac, un atacator trebuie doar s\u0103 ini\u021bieze verificarea Dockerfile-ului sau manifest.json-ului s\u0103u, care include metadate concepute special, sau s\u0103 plaseze \u00een interiorul imaginii fi\u0219ierele Podfile \u0219i gradlew. Prototipurile exploit-urilor au fost preg\u0103tite<\/a><\/noindex> pentru sisteme
\nWhiteSource<\/a><\/noindex>, Snyk<\/a><\/noindex>,
\nFossa<\/a><\/noindex> \u0219i
\nAnchore<\/a><\/noindex>. Pachetul Clair<\/a><\/noindex>, scris ini\u021bial cu o aten\u021bie special\u0103 asupra securit\u0103\u021bii, a demonstrat cea mai bun\u0103 securitate. Probleme nu au fost identificate \u00een pachetul Trivy<\/a><\/noindex>. \u00cen concluzie, s-a ajuns la concluzia c\u0103 scanerele containerelor Docker ar trebui rulat\u0103 \u00een medii izolate sau utilizate doar pentru verificarea propriilor imagini, precum \u0219i s\u0103 se manifeste pruden\u021b\u0103 atunci c\u00e2nd se conecteaz\u0103 astfel de instrumente la sistemele de integrare continu\u0103 automatizat\u0103.<\/p>\n

\u00cen FOSSA, Snyk \u0219i WhiteSource vulnerabilitatea a fost asociat\u0103 cu apelul unui manager de pachete extern pentru determinarea dependen\u021belor \u0219i a permis organizarea execut\u0103rii codului propriu prin specificarea comenzilor touch \u0219i system \u00een fi\u0219ierele gradlew<\/a><\/noindex> \u0219i Podfile<\/a><\/noindex>.<\/p>\n

\u00cen Snyk \u0219i WhiteSource au fost de asemenea g\u0103site<\/a><\/noindex> vulnerabilit\u0103\u021bi<\/a><\/noindex>, legate<\/a><\/noindex> cu organizarea lans\u0103rii comenzilor de sistem la analiza Dockerfile (de exemplu, \u00een Snyk prin Dockerfile se putea \u00eenlocui utilitarul \/bin\/ls, apelat de scaner, iar \u00een WhiteSource se putea introduce cod prin argumente sub forma \u201eecho ' ;touch \/tmp\/hacked_whitesource_pip;=1.0'\u201d). <\/p>\n

\u00cen Anchore vulnerabilitatea a fost cauzat\u0103 de<\/a><\/noindex> utilizarea utilitarului skopeo<\/a><\/noindex> pentru lucrul cu imaginile docker. Utilizarea se rezuma la ad\u0103ugarea \u00een fi\u0219ierul manifest.json a parametrilor de tip \u201e'os': '$(touch hacked_anchore)'\u201d, care sunt introdu\u0219i la apelul skopeo f\u0103r\u0103 o escapare corespunz\u0103toare (doar caracterele \u201e; &\u201d erau eliminate, dar se permitea construc\u021bia \u201e$()\u201d).<\/p>\n

Acela\u0219i autor a desf\u0103\u0219urat o cercetare asupra eficien\u021bei identific\u0103rii vulnerabilit\u0103\u021bilor necorectate de c\u0103tre scanerele de securitate ale containerelor docker \u0219i nivelul alarmelor false.partea 1<\/a><\/noindex>, partea 2<\/a><\/noindex>, partea 3<\/a><\/noindex>). Aici sunt prezentate rezultatele test\u0103rii a 73 de imagini, con\u021bin\u00e2nd vulnerabilit\u0103\u021bi cunoscute, precum \u0219i o evaluare a eficien\u021bei identific\u0103rii aplica\u021biilor standard \u00een imagini (nginx, tomcat, haproxy, gunicorn, redis, ruby, node).<\/p>\n

\"Vulnerabilit\u0103\u021bi<\/a><\/noindex><\/center><\/p>\n

\"Vulnerabilit\u0103\u021bi<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker. \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430, \u0447\u0442\u043e \u0432 4 \u0438\u0437 6 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0430\u043c \u0441\u043a\u0430\u043d\u0435\u0440 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 Snyk) \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93157,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een scanerele de securitate pentru imagini Docker-container | ProHoster","description":"Au fost publicate rezultatele test\u0103rii instrumentelor pentru identificare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T17:42:00+00:00","article:modified_time":"2020-09-03T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93156","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:00","updated":"2022-10-01 01:38:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/93156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=93156"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/93156\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/93157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=93156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=93156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=93156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}