CVE-2020-35193
📋 TL;DR
This vulnerability affects SonarQube Docker images based on Alpine Linux that have a blank root password. Attackers can gain root access to containers using these images, potentially compromising the entire container environment. Organizations using affected SonarQube Docker images are at risk.
💻 Affected Systems
- SonarQube Docker images
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full container compromise leading to data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized root access allowing configuration changes, data manipulation, and privilege escalation within the container environment.
If Mitigated
Limited impact if containers are properly isolated with network segmentation and minimal privileges.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to connect to the container with blank root credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated Docker images after the fix
Vendor Advisory: https://github.com/SonarSource/docker-sonarqube/security/advisories
Restart Required: Yes
Instructions:
1. Pull the latest SonarQube Docker image. 2. Stop and remove the vulnerable container. 3. Deploy a new container using the updated image. 4. Verify the fix by checking that root login with blank password fails.
🔧 Temporary Workarounds
Set root password in Dockerfile
linuxManually set a strong root password in the Dockerfile before building the image
RUN echo 'root:StrongPassword123!' | chpasswd
Disable root SSH access
linuxConfigure SSH to prevent root login entirely
RUN sed -i 's/^PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable containers
- Deploy host-based intrusion detection and monitor for root login attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to SSH into the container as root with blank password: 'ssh root@container_ip' and press enter when prompted for passwordCheck Version:
docker inspect sonarqube:tag | grep -i versionVerify Fix Applied:
Attempt the same SSH login - it should fail with authentication error📡 Detection & Monitoring
Log Indicators:
- Failed or successful root login attempts in auth.log
- SSH authentication logs showing blank password attempts
Network Indicators:
- SSH connection attempts to container ports
- Unusual outbound connections from containers
SIEM Query:
source="auth.log" AND ("root" AND "ssh") AND ("Accepted" OR "Failed")