CVE-2020-35189
📋 TL;DR
This vulnerability allows remote attackers to gain root access to Kong Docker containers by using a blank password for the root user. Systems running affected Kong Docker images are vulnerable, particularly those exposed to untrusted networks. The issue specifically affects Alpine-based Kong Docker images before version 1.0.2-alpine.
💻 Affected Systems
- Kong API Gateway Docker Image
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing attackers to execute arbitrary commands, steal sensitive data, install malware, or pivot to other systems.
Likely Case
Unauthorized root access leading to data exfiltration, service disruption, or deployment of cryptocurrency miners or other malicious payloads.
If Mitigated
Limited impact if container runs with non-root user, network access is restricted, and proper security monitoring is in place.
🎯 Exploit Status
Exploitation is trivial - attackers simply need SSH or direct access to the container with blank password authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.2-alpine and later
Vendor Advisory: https://github.com/Kong/docker-kong/security/advisories
Restart Required: Yes
Instructions:
1. Update Docker image: docker pull kong:1.0.2-alpine or later
2. Stop and remove existing container
3. Deploy new container with updated image
4. Verify no blank root password exists
🔧 Temporary Workarounds
Run container as non-root user
linuxConfigure Kong container to run with a non-root user to limit impact even if exploited
docker run --user 1000:1000 kong:tag
Set root password
linuxManually set a strong root password in the container
docker exec -it <container> passwd
Enter new password when prompted
🧯 If You Can't Patch
- Restrict network access to Kong containers using firewall rules or network policies
- Implement strict network segmentation and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if container uses Kong image before 1.0.2-alpine: docker images | grep kong
Test root login: docker exec -it <container> su - root (try blank password)Check Version:
docker inspect <container> | grep -i kongVerify Fix Applied:
Verify image version is 1.0.2-alpine or later and root login with blank password fails📡 Detection & Monitoring
Log Indicators:
- Failed or successful SSH/root login attempts
- Unusual root-level commands in container logs
Network Indicators:
- Unexpected SSH connections to container ports
- Outbound connections from Kong containers to suspicious destinations
SIEM Query:
source="docker" AND (event="login" OR user="root") AND result="success"