Login Sign Up

CVE-2020-29580

9.8 CRITICAL
Authentication Bypass

📋 TL;DR

This vulnerability allows remote attackers to gain root access to Storm Docker containers by using a blank password for the root user. Systems using affected Docker images before version 1.2.1 are vulnerable. This affects anyone deploying Storm via the official Docker images.

💻 Affected Systems

Products:
  • Storm Docker Official Image
Versions: All versions before 1.2.1
Operating Systems: Any OS running Docker
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects the official Docker image, not Storm software itself when installed via other methods.

📦 What is this software?

Storm Docker Image by Docker

View all CVEs affecting Storm Docker Image →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with root-level access, allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.

🟠

Likely Case

Unauthorized root access leading to data theft, service disruption, or container takeover for cryptocurrency mining or botnet participation.

🟢

If Mitigated

Limited impact if containers run with non-root users, proper network segmentation, and strong access controls preventing external connections.

🌐 Internet-Facing: HIGH - Containers exposed to the internet can be directly attacked without authentication.
🏢 Internal Only: MEDIUM - Internal attackers or compromised systems could exploit this, but requires network access to container ports.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation is trivial - attackers simply connect to SSH or other services and use blank password for root.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.1 and later

Vendor Advisory: https://github.com/koharin/koharin2/blob/main/CVE-2020-29580

Restart Required: Yes

Instructions:

1. Pull updated image: docker pull storm:1.2.1
2. Stop and remove old containers
3. Recreate containers using the new image
4. Verify no containers use old vulnerable images

🔧 Temporary Workarounds

Set root password

linux

Manually set a strong password for the root user in running containers

docker exec -it <container_name> passwd root

Disable root SSH

linux

Prevent root login via SSH in container configuration

echo 'PermitRootLogin no' >> /etc/ssh/sshd_config
service ssh restart

🧯 If You Can't Patch

  • Run containers with non-root users using Docker's --user flag
  • Implement strict network controls to limit container exposure

🔍 How to Verify

Check if Vulnerable:

Check Docker image version: docker images | grep storm
If version is earlier than 1.2.1, test SSH with blank root password.

Check Version:

docker images --format '{{.Repository}}:{{.Tag}}' | grep ^storm

Verify Fix Applied:

Confirm running containers use storm:1.2.1 or later: docker ps --format '{{.Image}}' | grep storm

📡 Detection & Monitoring

Log Indicators:

  • Failed SSH login attempts with root user
  • Successful root logins without authentication

Network Indicators:

  • Unexpected SSH connections to container ports
  • Traffic from container to suspicious external IPs

SIEM Query:

source="docker" AND (event="ssh_login" AND user="root" AND result="success")

📊 Metadata

CVE ID: CVE-2020-29580
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: December 8, 2020
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON