Docker Registry Authentication Endpoint Spoofing via Unvalidated Realm Parameter

Executive Summary

The vulnerability exists in the docker_pull module, which uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validating it.

An attacker positioned as a man-in-the-middle between the client (bbot) and the Docker registry can modify this header to redirect the authentication request to a malicious endpoint.

This redirection can lead to the leakage of authentication tokens to the attacker.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the leakage of authentication tokens if an attacker successfully performs a man-in-the-middle attack.

Leaked tokens could allow unauthorized access to Docker registries or other resources protected by those tokens.

However, the CVSS score is relatively low (3.1), indicating that exploitation requires certain conditions such as network access and user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially lead to the leakage of authentication tokens if an attacker successfully redirects authentication requests. Such leakage of sensitive authentication information may impact compliance with standards and regulations that require protection of authentication credentials and personal data, such as GDPR and HIPAA.

However, the provided information does not explicitly describe the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0