CVE-2020-35466
📋 TL;DR
The Blackfire Docker image through December 14, 2020 contains a blank root password, allowing remote attackers to gain root access without authentication. This affects any system running the vulnerable Blackfire container image. Attackers can achieve complete system compromise through this authentication bypass vulnerability.
💻 Affected Systems
- Blackfire Docker image
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root privileges, allowing installation of persistent backdoors, data exfiltration, and lateral movement to other systems.
Likely Case
Remote attackers gain root shell access to the container, enabling them to execute arbitrary commands, steal sensitive data, and pivot to other systems.
If Mitigated
If proper network segmentation and access controls are in place, impact may be limited to the container itself without affecting the host system.
🎯 Exploit Status
Exploitation requires only SSH or direct container access with blank password authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Images after 2020-12-14
Vendor Advisory: https://github.com/blackfireio/docker
Restart Required: Yes
Instructions:
1. Pull the latest Blackfire Docker image. 2. Stop and remove the vulnerable container. 3. Deploy new container using the updated image. 4. Verify the fix by attempting to authenticate with blank password.
🔧 Temporary Workarounds
Set root password
linuxManually set a strong password for the root user within the container
docker exec -it <container_name> passwd root
Disable root SSH access
linuxModify SSH configuration to prevent root login
docker exec -it <container_name> sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
docker exec -it <container_name> service ssh restart
🧯 If You Can't Patch
- Implement strict network access controls to limit container exposure
- Monitor for SSH authentication attempts with blank passwords
🔍 How to Verify
Check if Vulnerable:
Attempt SSH login to container with 'root' username and blank passwordCheck Version:
docker images | grep blackfireVerify Fix Applied:
Verify SSH login with blank password fails and requires authentication📡 Detection & Monitoring
Log Indicators:
- Failed SSH authentication attempts
- Successful SSH logins with blank password
- Root user login events
Network Indicators:
- SSH connections to container ports
- Unusual outbound connections from container
SIEM Query:
source="auth.log" AND (user="root" AND (password="" OR authentication="none"))