CVE-2020-35464
📋 TL;DR
CVE-2020-35464 is a critical authentication bypass vulnerability in Weave Cloud Agent Docker image version 1.3.0 where the root user has a blank password. This allows remote attackers to gain root access to systems running the vulnerable container. Organizations using Weave Cloud Agent Docker image version 1.3.0 are affected.
💻 Affected Systems
- Weave Cloud Agent Docker image
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing attackers to install malware, exfiltrate data, pivot to other systems, and maintain persistent access.
Likely Case
Unauthorized root access leading to container escape, data theft, and potential lateral movement within the environment.
If Mitigated
Limited impact if container runs with non-root user, network segmentation is enforced, and proper access controls are in place.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to connect to the container with blank root password.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.3.0
Vendor Advisory: https://github.com/weaveworks/weave-cloud-agent/security/advisories
Restart Required: Yes
Instructions:
1. Stop all containers running Weave Cloud Agent 1.3.0. 2. Pull updated image: docker pull weaveworks/weave-cloud-agent:latest. 3. Deploy new containers with updated image. 4. Remove old containers and images.
🔧 Temporary Workarounds
Run container as non-root user
linuxConfigure container to run with a non-root user to limit impact
docker run -u 1000:1000 weaveworks/weave-cloud-agent:1.3.0
Set root password
linuxManually set a strong root password in the container
docker exec -it <container_id> passwd root
🧯 If You Can't Patch
- Isolate affected containers using network segmentation and firewall rules
- Implement strict access controls and monitor for unauthorized root login attempts
🔍 How to Verify
Check if Vulnerable:
Check Docker image version: docker images | grep weave-cloud-agentCheck Version:
docker inspect <container_id> | grep -i versionVerify Fix Applied:
Verify new container version and test root login with blank password (should fail)📡 Detection & Monitoring
Log Indicators:
- Failed or successful root login attempts with blank/no password
- Unexpected root user activity in container logs
Network Indicators:
- Unexpected SSH or remote access connections to container ports
SIEM Query:
source="docker" AND (event="login" OR event="authentication") AND user="root" AND result="success"