Critical security vulnerability on Docker Hub

A Vulnerability on Docker Hub allowed admin access to the Python Package Index (PyPI) and the injection of malicious code. The JFrog Security Research Team recently identified and mitigated a critical security vulnerability that could have led to a catastrophic supply chain attack.

The vulnerability involved a leaked GitHub Personal Access Token (PAT) found in a container on Docker Hub, which allowed admin access to the Python Package Index (PyPI) and the repositories of the Python Software Foundation. The disclosure of this token could have allowed attackers to inject malicious code into Python packages, posing a significant risk to the global software infrastructure.

The Discovery Process JFrog Security continuously scans public repositories for vulnerabilities, and during one of these routine checks, a classic GitHub PAT was detected in a public Docker Hub repository. This token was embedded in a compiled Python file (.pyc) within a Docker container but was not present in the corresponding source code file. The likely scenario is that the token was temporarily added to the source code, which was then compiled, leaving the token in the binary file even after it was removed from the source code.

Impact of the Security Vulnerability The leaked token provided administrator access to 91 repositories of the Python organization, 55 under PyPA, 42 under PSF, and 21 under PyPI. If malicious actors had discovered and used this token, they could have injected harmful code into critical Python infrastructures, endangering millions of users worldwide by compromising widely used Python packages or the Python language itself.

Damage Control and Response After discovering the leaked token, JFrog immediately informed the PYPI security team. The team acted quickly and revoked the token within just 17 minutes, preventing potential misuse. The significant threat potential of this vulnerability underscores the importance of an immediate response to security breaches. A rapid and coordinated response is crucial to minimize potential damage and ensure the security of affected systems. The effective collaboration between JFrog and PYPI demonstrates the importance of a well-prepared and agile security strategy to act quickly in critical moments.

What Can We Learn from This Discovery?

• Comprehensive Secret Scanning: It is crucial to check both source code and binary artifacts for secret information. While scanning source code is essential, sensitive data can often be found in compiled binary files, as seen in this case.
• Use of Fine-Grained Tokens: GitHub’s newer fine-grained tokens offer better security as they allow more specific permissions compared to the older classic tokens. Organizations should transition to these tokens to minimize risks.
• Principle of Least Privilege: Tokens should only grant the minimum necessary access. Avoid creating tokens with broad access to multiple repositories or infrastructure components to reduce the risk of a token being leaked.

Conclusion The incident underscores the importance of thorough and robust security practices, including the detection of vulnerabilities and malicious code in binary files and rapid response to security breaches. Companies must implement comprehensive security measures to protect against potential supply chain attacks and ensure the integrity and security of their software infrastructure.

(ds/JFrog)