search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

PRP: Exposed Docker daemon Remote Access #480

Closed am0o0 closed 1 month ago

am0o0 commented 1 month ago

as we have in documentation docker daemon can be exposed by a network IP address too. please refer to https://docs.docker.com/config/daemon/remote-access/

By default, the Docker daemon listens for connections on a Unix socket to accept requests from local clients. It's possible to allow Docker to accept requests from remote hosts by configuring it to listen on an IP address and port as well as the Unix socket. For more detailed information on this configuration option, refer to the dockerd CLI reference.

tooryx commented 1 month ago

Thank you @am0o0 for willing to contribute. It seems like we already have a detector for this: https://github.com/google/tsunami-security-scanner-plugins/tree/master/google/detectors/exposedui/docker

Feel free to reopen an issue if you think I was mistaken.

~tooryx

am0o0 commented 1 month ago

@tooryx you are correct but the plugin you mentioned simply checks for a response, I can check for out-of-band calls with command execution which I guess is your preferred method.

am0o0 commented 1 month ago

Also, I think that I don't have enough permission to reopen this issue.

am0o0 commented 1 month ago

I found a similar issue in which @JamesFoxxx improved the current plugin. https://github.com/google/tsunami-security-scanner-plugins/issues/441

tooryx commented 1 month ago

I will discuss it with the rest of the devteam.

tooryx commented 1 month ago

Hi @am0o0,

I discussed this with the rest of the devteam. If it would indeed improve the quality of the plugin, it is not the priority right now and we would rather work on other detectors.

Please let me know your thoughts, ~tooryx