A recent study conducted by researchers at the RWTH Aachen University in Germany has uncovered a significant security vulnerability within Docker Hub, the popular cloud-based repository for Docker images. The findings reveal that tens of thousands of container images hosted on Docker Hub contain confidential secrets, posing a massive attack surface for potential hackers.

Docker Hub serves as a repository where the Docker community can store, share, and distribute Docker images, which are container-creation templates encompassing all the necessary software code, runtime, libraries, environment variables, and configuration files needed to easily deploy applications in Docker.

The German researchers meticulously analyzed a staggering 337,171 images sourced from Docker Hub and thousands of private registries. Shockingly, they discovered that approximately 8.5 per cent of these images contain sensitive data, including private keys and API secrets that malicious actors could exploit.

The researchers assembled a massive dataset comprising 1,647,300 layers from 337,171 Docker images, ensuring the inclusion of the latest image versions from each repository whenever possible. Through data analysis using regular expressions to identify specific secrets, they exposed the presence of 52,107 valid private keys and 3,158 distinct API secrets within 28,621 Docker images.

To ensure the accuracy of their findings, the researchers diligently validated the figures, excluding test keys, example API secrets, and invalid matches. The study revealed that most exposed secrets, 95 per cent of private keys and 90 per cent of API secrets, were found in single-user images, suggesting that these leaks were most likely inadvertent.

Interestingly, Docker Hub exhibited the highest rate of secret exposure, with 9.0 per cent of its images containing sensitive information. In contrast, images sourced from private registries had a lower exposure rate of 6.3 per cent. This disparity implies that Docker Hub users may have a poorer understanding of container security compared to those setting up private repositories.

The researchers also delved into using the exposed secrets to assess the extent of the attack surface. Alarmingly, they discovered 22,082 compromised certificates relying on the exposed private keys, including 7,546 private certificates signed by certificate authorities (CAs) and 1,060 public CA-signed certificates. The existence of a thousand CA-signed certificates is particularly concerning, as these certificates are widely accepted and used by many users.

The researchers utilized 15 months’ worth of internet-wide measurements from the Censys database to determine the real-world impact. They identified a staggering 275,269 hosts that depend on the compromised keys, including MQTT and AMQP hosts responsible for transferring privacy-sensitive Internet of Things (IoT) data, FTP and database instances handling potentially confidential information, SIP hosts used for telephony, email servers, SSH servers, and Kubernetes instances.