Today, I don’t know any organization that is using Docker today. For only test and development only or to full production systems, containers are deployed everywhere! In the same way, most popular tools today have a “dockerized” version ready to use, sometimes maintained by the developers themselves, sometimes maintained by third parties. An example is the Docker container that I created with all Didier’s tools. Today, we are also facing a new threat: supply chain attacks (think about Solarwinds or, more recently, CodeCov). Let’s mix the attraction for container technologies and this threat, we realize that Docker images are a great way to compromise an organization!
When we deploy Docker images, we have to take care of two things:
- Vulnerabilities present in the software installed in the image.
- Potential malicious changes (implementation of a backdoor, extra SSH keys, exfiltration of data, etc…)
Many Docker images have already been detected as malicious and are more difficult to detect but how to address “common” vulnerabilities? When you are implementing a vulnerability scanning process in your organization (note that I say “process” and not “tool”!), there are components that are difficult to scan like virtual machines in suspended mode and… Docker images!
Here is an interesting tool that you can add to your arsenal to quickly scan Docker images for vulnerabilities: grype. Written in Go, the tool is very easy to deploy and use:
[email protected]:/# docker images|grep ssl drwetter/testssl.sh latest 699c2c42986f 7 weeks ago 48.5MB jumanjiman/ssllabs-scan latest 2a46bf22e388 10 months ago 5.66MB [email protected]:/# grype docker:drwetter/testssl.sh:latest - Vulnerability DB [no update available] - Loaded image - Parsed image - Cataloged packages [36 packages] - Scanned image [2 vulnerabilities] NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY openssl 1.1.1j-r0 CVE-2021-3450 High openssl 1.1.1j-r0 CVE-2021-3449 Medium
grype scans the contents of the Docker image to find know vulnerabilities at the operating system level (Alpine, Busybox, Ubuntu, …) but also language-specific issues (Ruby, Java, Python, …). Personally, I like the JSON output (
--output=json) to process the results with other tools or index them.
My advice is to scan all your new Docker images, especially the ones that you downloaded from 3rd party websites.
And you? How do you scan/audit your Docker images? Please share your tools/processes in the comments.
Xavier Mertens (@xme)
Senior ISC Handler – Freelance Cyber Security Consultant
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.