2

Fair warning - I am a security newbie.

In all container escape/breakout vulnerability scenarios I've read (CVE-2022-0185), the author assumes or states that the attacker already had shell or SSH access to the container. When I follow this tutorial, if the container is misconfigured, sure then it's easy enough to escape the container to the host. But I can't find any good write-ups on how an attacker would get access to the container in the first place.

2
  • 1
    Typically, the attacker would exploit some other vulnerability on the server, such as Log4Shell, which they can use to gain shell access to the server.
    – mti2935
    Mar 17, 2023 at 22:26
  • Or just use either stolen (phished) or through brute-forcing found credentials. Mar 18, 2023 at 5:56

1 Answer 1

1

There's a couple of ways that an attacker might get access to a container. First one is by compromising the application running in the container.

Essentially many containers will run things like web applications, which can have their own weaknesses and exploits. An attacker who compromises the web application with something like command injection will get access to the container, and their idea after that is to try and breakout.

Another way (with things like Kubernetes) is that an attacker might get access to a set of Kubernetes credentials which allow access to containers (e.g. a developer or devops set of credentials). At this point they can access a container to try and escalate their privileges further.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .