CVE-2020-29591
📋 TL;DR
This vulnerability allows remote attackers to gain root access to Docker registry containers by using a blank password for the root user. It affects systems running vulnerable versions of the official Docker registry image. Attackers can potentially compromise the entire container and access or modify stored container images.
💻 Affected Systems
- Docker Official Registry Image
📦 What is this software?
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
Registry by Docker
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Docker registry container with root access, allowing attackers to steal, modify, or delete all container images, inject malicious images into the supply chain, and pivot to other systems.
Likely Case
Unauthorized access to the registry leading to image theft or tampering, potentially affecting downstream deployments that pull from the compromised registry.
If Mitigated
Limited impact if registry is isolated, not internet-facing, and has network controls preventing unauthorized access attempts.
🎯 Exploit Status
Exploitation requires authentication attempt with blank password, which is trivial to attempt. Public proof-of-concept code exists demonstrating the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.7.1 and later
Vendor Advisory: https://github.com/docker/distribution-library-image
Restart Required: Yes
Instructions:
1. Pull the updated registry image: docker pull registry:2.7.1
2. Stop the vulnerable container
3. Recreate container using the updated image
4. Verify the fix by checking container logs and testing authentication
🔧 Temporary Workarounds
Set root password
linuxManually set a strong password for the root user inside the container
docker exec -it <container_name> passwd root
Disable root login
linuxConfigure the container to disable root SSH/login access
docker exec -it <container_name> usermod -L root
🧯 If You Can't Patch
- Implement strict network controls to limit access to registry container only from trusted sources
- Monitor authentication logs for failed login attempts and blank password usage
🔍 How to Verify
Check if Vulnerable:
Check the registry image version: docker images | grep registry
If version is 2.7.0 or earlier, the system is vulnerable.Check Version:
docker images --format '{{.Repository}}:{{.Tag}}' | grep registryVerify Fix Applied:
Attempt to authenticate with blank password after update - should fail. Check container logs for successful authentication attempts.📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with blank/empty password
- Successful root login from unexpected sources
- Failed password attempts followed by successful login
Network Indicators:
- SSH or authentication protocol traffic to registry container from unauthorized sources
- Unusual data export from registry
SIEM Query:
source="docker" AND ("blank password" OR "empty password" OR "root login")