CVE-2020-35195
📋 TL;DR
This vulnerability allows remote attackers to gain root access to systems running affected HAProxy Docker images by using a blank password. It affects anyone using official HAProxy Docker images before version 1.8.18-alpine. The root user having no password enables complete system compromise.
💻 Affected Systems
- HAProxy Docker Official Image
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root access, allowing installation of persistent backdoors, data theft, and lateral movement within the network.
Likely Case
Container escape leading to host system compromise, enabling attackers to access other containers and sensitive data.
If Mitigated
Limited impact if containers run with non-root users, proper network segmentation, and strong authentication controls.
🎯 Exploit Status
Exploitation requires network access to the container. Simple SSH or console access with blank password works.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.18-alpine and later
Vendor Advisory: https://github.com/docker-library/official-images/issues/8781
Restart Required: Yes
Instructions:
1. Pull updated image: docker pull haproxy:1.8.18-alpine
2. Stop running container: docker stop [container_name]
3. Remove old container: docker rm [container_name]
4. Run new container with updated image
🔧 Temporary Workarounds
Set root password
linuxManually set a strong password for the root user in the container
docker exec -it [container_name] passwd
Run as non-root user
linuxConfigure container to run HAProxy as non-root user
docker run --user 1000:1000 haproxy:[version]
🧯 If You Can't Patch
- Implement strict network access controls to limit container exposure
- Monitor for SSH login attempts with blank passwords and container escape activities
🔍 How to Verify
Check if Vulnerable:
Check Docker image version: docker images | grep haproxyCheck Version:
docker inspect --format='{{.Config.Image}}' [container_name]Verify Fix Applied:
Verify running container uses patched version: docker ps --format 'table {{.Names}}\t{{.Image}}' | grep haproxy📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts
- Successful root login with blank password
- Container escape attempts
Network Indicators:
- Unexpected SSH connections to containers
- Outbound connections from containers to suspicious destinations
SIEM Query:
source="docker" AND (event="login" AND user="root" AND password="") OR event="container_escape"