CVE-2020-35197
📋 TL;DR
This vulnerability allows remote attackers to gain root access to systems running affected memcached Docker images by using a blank password. It affects anyone using official memcached Docker images before version 1.5.11-alpine. The root user has a blank password by default in these vulnerable images.
💻 Affected Systems
- official memcached Docker images
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing attackers to install malware, exfiltrate data, pivot to other systems, or destroy the container environment.
Likely Case
Attackers gain root access to the container, potentially accessing sensitive data in memcached, modifying cached data, or using the container as a foothold for lateral movement.
If Mitigated
Limited impact if proper network segmentation, container isolation, and authentication controls prevent access to the vulnerable service.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to connect to the memcached service and attempt root login with blank password.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.11-alpine and later
Vendor Advisory: https://github.com/docker-library/memcached/issues/1
Restart Required: Yes
Instructions:
1. Pull the updated image: docker pull memcached:1.5.11-alpine
2. Stop the vulnerable container
3. Remove the vulnerable container
4. Deploy new container using the patched image
🔧 Temporary Workarounds
Set root password in Dockerfile
linuxCreate a custom Dockerfile that sets a strong root password before running memcached
FROM memcached:alpine
RUN echo 'root:StrongPassword123!' | chpasswd
Run as non-root user
linuxConfigure the container to run memcached as a non-root user
docker run -u 1000:1000 memcached:alpine
🧯 If You Can't Patch
- Implement strict network controls to limit access to memcached port (11211) only to trusted systems
- Use container security tools to monitor for root login attempts and unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check Docker image version: docker images | grep memcached. If version is earlier than 1.5.11-alpine, you are vulnerable.Check Version:
docker exec <container_name> memcached -VVerify Fix Applied:
After updating, verify the image version is 1.5.11-alpine or later and test that root login with blank password fails.📡 Detection & Monitoring
Log Indicators:
- Failed or successful root login attempts in container logs
- Authentication events with blank password
Network Indicators:
- Unexpected connections to memcached port 11211
- Brute force attempts against memcached service
SIEM Query:
source="docker" AND "memcached" AND ("root" OR "authentication" OR "login")