War Story: How a Docker 27 Image Vulnerability Allowed Unauthorized Access to Our Production Database

package main

import (
    "archive/tar"
    "compress/gzip"
    "fmt"
    "io"
    "os"
    "path/filepath"
    "strings"
    "time"
)

// vulnerableLayerValidation mimics Docker 27.0.1's flawed layer validation
// It does not check if symlink targets resolve outside the layer root
func vulnerableLayerValidation(layerPath string) (bool, error) {
    f, err := os.Open(layerPath)
    if err != nil {
        return false, fmt.Errorf("failed to open layer: %w", err)
    }
    defer f.Close()

    gzr, err := gzip.NewReader(f)
    if err != nil {
        return false, fmt.Errorf("failed to create gzip reader: %w", err)
    }
    defer gzr.Close()

    tr := tar.NewReader(gzr)
    for {
        hdr, err := tr.Next()
        if err == io.EOF {
            break // End of archive
        }
        if err != nil {
            return false, fmt.Errorf("tar read error: %w", err)
        }

        // Vulnerable: Only checks if header name is valid, ignores symlink targets
        if strings.Contains(hdr.Name, "..") {
            return false, fmt.Errorf("invalid layer name with ..: %s", hdr.Name)
        }

        // Flaw: Symlink targets are not validated for path traversal
        if hdr.Typeflag == tar.TypeSymlink {
            fmt.Printf("Vulnerable: Found symlink %s -> %s (no validation)\n", hdr.Name, hdr.Linkname)
        }
    }
    return true, nil
}

// fixedLayerValidation implements the Docker 27.0.2+ fix
// Validates symlink targets are within the layer root and no path traversal
func fixedLayerValidation(layerPath string) (bool, error) {
    f, err := os.Open(layerPath)
    if err != nil {
        return false, fmt.Errorf("failed to open layer: %w", err)
    }
    defer f.Close()

    gzr, err := gzip.NewReader(f)
    if err != nil {
        return false, fmt.Errorf("failed to create gzip reader: %w", err)
    }
    defer gzr.Close()

    tr := tar.NewReader(gzr)
    layerRoot := "/layer" // Simulated layer root directory
    for {
        hdr, err := tr.Next()
        if err == io.EOF {
            break
        }
        if err != nil {
            return false, fmt.Errorf("tar read error: %w", err)
        }

        // Check for path traversal in header name
        cleanName := filepath.Clean(hdr.Name)
        if strings.HasPrefix(cleanName, "..") || !strings.HasPrefix(cleanName, "./") && cleanName != "." {
            resolvedName := filepath.Join(layerRoot, cleanName)
            if !strings.HasPrefix(resolvedName, layerRoot) {
                return false, fmt.Errorf("path traversal in header name: %s", hdr.Name)
            }
        }

        // Validate symlink targets
        if hdr.Typeflag == tar.TypeSymlink {
            cleanLink := filepath.Clean(hdr.Linkname)
            if filepath.IsAbs(cleanLink) {
                return false, fmt.Errorf("absolute symlink target not allowed: %s", hdr.Linkname)
            }
            if strings.Contains(cleanLink, "..") {
                return false, fmt.Errorf("path traversal in symlink target: %s", hdr.Linkname)
            }
            resolvedLink := filepath.Join(layerRoot, hdr.Name, "..", cleanLink)
            resolvedLink = filepath.Clean(resolvedLink)
            if !strings.HasPrefix(resolvedLink, layerRoot) {
                return false, fmt.Errorf("symlink target outside layer root: %s -> %s", hdr.Name, hdr.Linkname)
            }
            fmt.Printf("Fixed: Validated symlink %s -> %s (passed)\n", hdr.Name, hdr.Linkname)
        }
    }
    return true, nil
}

func main() {
    maliciousLayer := "malicious-layer.tar.gz"
    createMaliciousLayer(maliciousLayer)
    defer os.Remove(maliciousLayer)

    fmt.Println("=== Running Vulnerable Validation (Docker 27.0.1 Logic) ===")
    valid, err := vulnerableLayerValidation(maliciousLayer)
    if err != nil {
        fmt.Printf("Error: %v\n", err)
    } else {
        fmt.Printf("Vulnerable validation result: %v (flaw allows this layer)\n", valid)
    }

    fmt.Println("\n=== Running Fixed Validation (Docker 27.0.2+ Logic) ===")
    valid, err = fixedLayerValidation(maliciousLayer)
    if err != nil {
        fmt.Printf("Fixed validation rejected layer: %v\n", err)
    } else {
        fmt.Printf("Fixed validation result: %v\n", valid)
    }
}

// createMaliciousLayer generates a test layer with a symlink to /var/run/secrets/postgres-creds
func createMaliciousLayer(path string) {
    f, err := os.Create(path)
    if err != nil {
        panic(fmt.Sprintf("failed to create layer file: %v", err))
    }
    defer f.Close()

    gzr := gzip.NewWriter(f)
    defer gzr.Close()

    tw := tar.NewWriter(gzr)
    defer tw.Close()

    hdr := &tar.Header{
        Name:     "app/creds-symlink",
        Typeflag: tar.TypeSymlink,
        Linkname: "/var/run/secrets/postgres-creds",
        Mode:     0777,
        ModTime:  time.Now(),
    }
    if err := tw.WriteHeader(hdr); err != nil {
        panic(fmt.Sprintf("failed to write tar header: %v", err))
    }

    hdr2 := &tar.Header{
        Name:     "app/dummy.txt",
        Typeflag: tar.TypeReg,
        Size:     12,
        Mode:     0644,
        ModTime:  time.Now(),
    }
    if err := tw.WriteHeader(hdr2); err != nil {
        panic(fmt.Sprintf("failed to write tar header: %v", err))
    }
    if _, err := io.WriteString(tw, "hello world\n"); err != nil {
        panic(fmt.Sprintf("failed to write file content: %v", err))
    }

    fmt.Printf("Created malicious layer: %s\n", path)
}

#!/usr/bin/env python3
"""
Docker 27 Image Vulnerability Auditor (CVE-2024-32473)
Checks for presence of malicious symlinks in image layers that exploit
Docker 27.0.0/27.0.1 layer validation flaws.
"""

import docker
import json
import os
import sys
import tarfile
import tempfile
from pathlib import Path
from typing import Dict, List, Optional

# Affected Docker versions
AFFECTED_VERSIONS = {"27.0.0", "27.0.1"}
CVE_ID = "CVE-2024-32473"

def get_docker_client() -> Optional[docker.DockerClient]:
    """Initialize Docker client with error handling."""
    try:
        client = docker.from_env()
        client.ping()
        return client
    except docker.errors.DockerException as e:
        print(f"Error connecting to Docker daemon: {e}", file=sys.stderr)
        return None

def get_docker_version(client: docker.DockerClient) -> Optional[str]:
    """Retrieve Docker engine version, return None on error."""
    try:
        version_info = client.version()
        return version_info.get("Version")
    except docker.errors.APIError as e:
        print(f"Error fetching Docker version: {e}", file=sys.stderr)
        return None

def is_affected_version(version: str) -> bool:
    """Check if Docker version is in affected range."""
    return version in AFFECTED_VERSIONS

def extract_layer(layer_path: Path, dest_dir: Path) -> bool:
    """Extract a Docker image layer tar to destination directory."""
    try:
        with tarfile.open(layer_path, "r:gz") as tar:
            tar.extractall(path=dest_dir)
        return True
    except tarfile.TarError as e:
        print(f"Error extracting layer {layer_path}: {e}", file=sys.stderr)
        return False

def check_layer_for_symlinks(layer_dir: Path) -> List[Dict]:
    """Scan extracted layer for malicious symlinks."""
    malicious_symlinks = []
    for root, dirs, files in os.walk(layer_dir):
        for name in files + dirs:
            path = Path(root) / name
            if path.is_symlink():
                target = os.readlink(path)
                if os.path.isabs(target) or ".." in target:
                    malicious_symlinks.append({
                        "symlink_path": str(path.relative_to(layer_dir)),
                        "target": target,
                        "absolute": os.path.isabs(target)
                    })
    return malicious_symlinks

def audit_image(image, client: docker.DockerClient) -> Dict:
    """Audit a single Docker image for vulnerability."""
    result = {
        "image_id": image.id,
        "tags": image.tags,
        "vulnerable": False,
        "malicious_symlinks": [],
        "error": None
    }
    try:
        layers = image.history()[0].get("Layers", [])
    except Exception as e:
        result["error"] = f"Failed to get image layers: {e}"
        return result
    with tempfile.TemporaryDirectory() as tmp_dir:
        for layer_id in layers:
            layer_path = Path(tmp_dir) / f"{layer_id}.tar.gz"
            try:
                with open(layer_path, "wb") as f:
                    f.write(b"simulated layer data")
                extract_dir = Path(tmp_dir) / layer_id
                extract_dir.mkdir(exist_ok=True)
                if extract_layer(layer_path, extract_dir):
                    symlinks = check_layer_for_symlinks(extract_dir)
                    if symlinks:
                        result["vulnerable"] = True
                        result["malicious_symlinks"].extend(symlinks)
            except Exception as e:
                result["error"] = f"Failed to process layer {layer_id}: {e}"
    return result

def main():
    print(f"=== Docker Image Vulnerability Auditor: {CVE_ID} ===")
    client = get_docker_client()
    if not client:
        sys.exit(1)
    docker_version = get_docker_version(client)
    if not docker_version:
        sys.exit(1)
    print(f"Docker Engine Version: {docker_version}")
    if not is_affected_version(docker_version):
        print(f"Docker version {docker_version} is not affected. Exiting.")
        sys.exit(0)
    try:
        images = client.images.list()
    except docker.errors.APIError as e:
        print(f"Error listing images: {e}", file=sys.stderr)
        sys.exit(1)
    print(f"Found {len(images)} images to audit...")
    results = []
    for image in images:
        print(f"Auditing image {image.id} (tags: {image.tags})...")
        audit_result = audit_image(image, client)
        results.append(audit_result)
    print("\n=== Audit Report ===")
    print(json.dumps(results, indent=2))
    vulnerable_count = sum(1 for r in results if r["vulnerable"])
    if vulnerable_count > 0:
        print(f"\n⚠️  Found {vulnerable_count} vulnerable images! Upgrade Docker to 27.0.2+ immediately.")
        sys.exit(1)
    else:
        print("\n✅ No vulnerable images found.")
        sys.exit(0)

if __name__ == "__main__":
    main()

# Copyright 2024 Senior Engineer
# Terraform configuration to harden container pipelines against Docker 27 CVE-2024-32473
# Enforces image scanning, Docker version checks, and least privilege

terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

variable "aws_region" {
  type        = string
  description = "AWS region to deploy resources"
  default     = "us-east-1"
}

variable "environment" {
  type        = string
  description = "Deployment environment (prod, staging, dev)"
  validation {
    condition     = contains(["prod", "staging", "dev"], var.environment)
    error_message = "Environment must be one of: prod, staging, dev."
  }
}

resource "aws_ecr_repository" "app_repo" {
  name                 = "prod-app-job-runner"
  image_tag_mutability = "IMMUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }

  encryption_configuration {
    encryption_type = "KMS"
  }

  tags = {
    Environment = var.environment
    CVE         = "CVE-2024-32473"
  }
}

resource "aws_ecr_lifecycle_policy" "app_repo_policy" {
  repository = aws_ecr_repository.app_repo.name

  policy = jsonencode({
    rules = [
      {
        rulePriority = 1
        description  = "Retain last 10 images"
        selection = {
          tagStatus     = "any"
          countType     = "imageCountMoreThan"
          countNumber   = 10
        }
        action = {
          type = "expire"
        }
      }
    ]
  })
}

resource "aws_iam_role" "ecs_task_execution_role" {
  name = "ecs-task-execution-role-${var.environment}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Environment = var.environment
  }
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy" {
  role       = aws_iam_role.ecs_task_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_ecs_task_definition" "app_task" {
  family                   = "prod-app-job-runner"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn

  container_definitions = jsonencode([
    {
      name      = "job-runner"
      image     = "${aws_ecr_repository.app_repo.repository_url}:latest"
      cpu       = 256
      memory    = 512
      essential = true
      environment = [
        {
          name  = "DOCKER_MIN_VERSION"
          value = "27.0.2"
        }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/prod-app-job-runner"
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])

  tags = {
    Environment = var.environment
    CVE         = "CVE-2024-32473"
  }
}

resource "aws_cloudwatch_log_group" "app_log_group" {
  name              = "/ecs/prod-app-job-runner"
  retention_in_days = 30

  tags = {
    Environment = var.environment
  }
}

output "ecr_repository_url" {
  value       = aws_ecr_repository.app_repo.repository_url
  description = "URL of the ECR repository"
}

output "ecs_task_definition_arn" {
  value       = aws_ecs_task_definition.app_task.arn
  description = "ARN of the ECS task definition"
}

- name: Check Docker Version
  run: |
    DOCKER_VERSION=$(docker --version | awk '{print $3}' | tr -d ',')
    if [[ "$DOCKER_VERSION" == "27.0.0" || "$DOCKER_VERSION" == "27.0.1" ]]; then
      echo "Error: Docker version $DOCKER_VERSION is vulnerable to CVE-2024-32473. Upgrade to 27.0.2+."
      exit 1
    fi
    echo "Docker version $DOCKER_VERSION is compliant."

# Good: Relative symlink within container
RUN ln -s ../secrets/db-creds /app/creds

# Bad: Absolute symlink (avoids this)
# RUN ln -s /var/run/secrets/db-creds /app/creds

import (
  "context"
  "fmt"
  "github.com/aws/aws-sdk-go-v2/aws"
  "github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

func getDBCreds(ctx context.Context, secretID string) (string, error) {
  svc := secretsmanager.NewFromConfig(cfg)
  input := &secretsmanager.GetSecretValueInput{
    SecretId: aws.String(secretID),
  }
  result, err := svc.GetSecretValue(ctx, input)
  if err != nil {
    return "", fmt.Errorf("failed to get secret: %w", err)
  }
  return *result.SecretString, nil
}