CVE-2020-35469
📋 TL;DR
The Software AG Terracotta Server OSS Docker image version 5.4.1 has a blank root password, allowing remote attackers to gain root access without authentication. This affects any system running the vulnerable Docker container. Attackers can fully compromise affected systems.
💻 Affected Systems
- Software AG Terracotta Server OSS Docker image
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root privileges, data theft, ransomware deployment, and lateral movement to other systems.
Likely Case
Unauthorized root access leading to data exfiltration, installation of backdoors, or cryptocurrency mining.
If Mitigated
Limited impact if container runs in isolated environment with no network access to root services.
🎯 Exploit Status
Exploitation requires only SSH or similar access to the container with blank password. No special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.4.2 or later
Vendor Advisory: https://github.com/SoftwareAG/terracotta-server-oss
Restart Required: Yes
Instructions:
1. Pull updated Docker image: docker pull softwareag/terracotta-server-oss:latest
2. Stop and remove old container
3. Deploy new container with updated image
4. Verify root password is set or SSH disabled
🔧 Temporary Workarounds
Set root password manually
linuxManually set a strong root password inside the container
docker exec -it <container_name> passwd root
Disable SSH/root access
linuxRemove SSH service or disable root login
docker exec -it <container_name> apt-get remove openssh-server
docker exec -it <container_name> sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
🧯 If You Can't Patch
- Isolate container network: Use Docker network policies to restrict access to container
- Implement strict firewall rules blocking SSH port 22 to container
🔍 How to Verify
Check if Vulnerable:
Check if container is using vulnerable image: docker inspect <container_name> | grep 'softwareag/terracotta-server-oss:5.4.1'Check Version:
docker inspect <container_name> | grep ImageVerify Fix Applied:
Attempt SSH login with blank password: ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no root@<container_ip>📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts followed by successful login
- Multiple SSH connections from unusual sources
- Authentication logs showing root login without password
Network Indicators:
- SSH traffic to container port 22 from unexpected sources
- Unusual outbound connections from container
SIEM Query:
source="auth.log" ("Accepted password for root" AND "from") OR ("session opened for user root" AND sshd)