A recent analysis of Docker Hub images conducted by Kaspersky has revealed that only 10% of the analyzed files were fully updated.
Specifically, the study examined files with download counts ranging from 10,000 to one million. Consequently, researchers warned that outdated software and compromised update sources present significant security risks to modern development environments.
Security Risks in Docker Hub images
Docker Hub serves as the largest container registry globally, recording more than 11 billion monthly image pulls. However, using these ready-made Docker Hub images without modifications can expose corporate networks to severe cyber threats.
For instance, attackers can exploit hijacked containers to launch distributed denial-of-service attacks or conduct unauthorized cryptocurrency mining. Furthermore, compromised containers allow malicious actors to steal data, access neighboring systems, or escape to the broader enterprise network.
“Infrastructure hosted in containers is an attractive target for attackers, as a hijacked container can be used for DDoS attacks, cryptocurrency mining, or traffic proxying.”
Kaspersky Research Team
Software Vulnerabilities and Manual Patching
Unlike traditional servers, pre-built container files lack automated security patching mechanisms. Therefore, developers must manually rebuild and redeploy their containers to address newly discovered security flaws.
A random scan of 100 files with up to one million downloads showed that 64% contained critical vulnerabilities. Notably, these flaws could allow attackers to execute remote code, crash server processes, or gain root privileges through local access.
Common Configuration Vulnerabilities
Even fully patched containers remain vulnerable if developers configure them incorrectly during deployment. Specifically, common errors include insecure credential handling, privilege escalation, and a complete lack of integrity checks.
For example, some containers use default passwords set via environment variables or directly within the Dockerfile. Meanwhile, passing passwords through command-line arguments exposes them to other system users, increasing the risk of unauthorized access.
Additionally, gaining root access inside a container allows attackers to control internal processes and conceal their activities. This privilege escalation often occurs due to insecurely configured file permissions or passwordless sudo commands.
Furthermore, downloading software without verifying its integrity makes infrastructure vulnerable to tampering. Specifically, using the HTTP protocol without archive verification allows man-in-the-middle attacks during the build phase, potentially compromising the entire environment.
Mitigation Strategies for Security Teams
To address these risks, Kaspersky recommends using its container security solution, which features the KIRA artificial intelligence assistant. This tool helps developers identify insecure configurations and suggests specific fixes for detected vulnerabilities.
Moreover, security teams should adopt a multi-layered defense strategy to secure their development pipelines. This approach includes pinning dependencies to verified versions and conducting mandatory malware scans on all final Docker Hub images before deployment.
