CVE-2020-35184
📋 TL;DR
This vulnerability allows remote attackers to gain root access to systems running affected Composer Docker images by using a blank password. Anyone using official Composer Docker images before version 1.8.3 is affected. The vulnerability stems from a misconfiguration where the root user has no password set.
💻 Affected Systems
- Official Composer Docker images
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing attackers to install malware, exfiltrate data, pivot to other systems, or destroy the container environment.
Likely Case
Unauthorized root access leading to data theft, container escape attempts, or deployment of malicious containers within the environment.
If Mitigated
Limited impact if containers are properly isolated with network restrictions, minimal privileges, and monitored for suspicious root login attempts.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to attempt root login with blank password. No special tools or techniques required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.3 and later
Vendor Advisory: https://github.com/docker-library/official-images/issues/8760
Restart Required: Yes
Instructions:
1. Pull the updated image: docker pull composer:latest
2. Update your Dockerfiles to use composer:1.8.3 or later
3. Rebuild and redeploy all containers using the vulnerable image
4. Remove old vulnerable images: docker image prune -a
🔧 Temporary Workarounds
Set root password in Dockerfile
linuxManually set a strong root password in your Dockerfile before building the image
RUN echo 'root:StrongPassword123!' | chpasswd
Disable root SSH access
linuxConfigure SSH to prevent root login entirely
RUN sed -i 's/^PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable containers
- Deploy host-based intrusion detection to monitor for root login attempts
🔍 How to Verify
Check if Vulnerable:
Check Docker image version: docker images | grep composer
If version is earlier than 1.8.3, test root login: docker exec -it <container> su root (try blank password)Check Version:
docker images --format '{{.Repository}}:{{.Tag}}' | grep composerVerify Fix Applied:
After updating, verify version is 1.8.3+: docker images | grep composer
Test that root login with blank password fails📡 Detection & Monitoring
Log Indicators:
- Failed or successful root login attempts in auth logs
- Multiple authentication failures followed by success
Network Indicators:
- SSH brute force attempts targeting root user
- Unexpected outbound connections from containers
SIEM Query:
source="auth.log" AND ("root" AND "Accepted password") OR ("root" AND "authentication failure")