Listen to this Post
The vulnerability exists in the registry client implementation of Docker Distribution, specifically within the manifest fetching logic. When a client requests a manifest by its cryptographic digest, the underlying code reads the response body from the registry without computing its hash to verify against the requested value. Instead, it relies blindly on the server-supplied Docker-Content-Digest response header. A malicious or compromised registry, or an attacker positioned as a Man-in-the-Middle (MITM) on the connection, can exploit this flaw by serving arbitrary manifest content alongside a forged response header matching the requested digest. Consequently, the client accepts the substituted content transparently, entirely undermining the security guarantees of digest pinning relied upon by image policy controllers, mirrors, and pull-through caches.
DailyCVE Form:
Platform: Docker Distribution
Version: v2.8.3 and prior
Vulnerability : Digest Pinning Bypass
Severity: High
date: 2024-08-13
Prediction: 2024-08-20
What Undercode Say:
func (ms manifests) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {
...
resp, err := ms.client.Get(u)
...
body, err := ioutil.ReadAll(resp.Body) // missing digest check
...
m, _, err := distribution.UnmarshalManifest(ct, body)
return m, err
}
Exploit: (Educational Purposes!)
An attacker can set up a malicious server or intercept a registry connection using TLS MITM techniques. When the client sends a request to fetch a manifest by a specific digest, the attacker responds with an alternative malicious manifest body while falsifying the `Docker-Content-Digest` header to match the expected hash. Because the client lacks body verification against the requested digest, it processes the forged payload without raising any errors, effectively injecting unauthorized image components.
Protection: from this CVE
To protect against this vulnerability, update Docker Distribution components and libraries to the patched versions where the client computes the cryptographic hash of the received response body and explicitly compares it against the user-supplied digest before unmarshalling. Avoid untrusted registries and ensure strict TLS verification are enforced across all endpoints.
Impact:
Successful exploitation of this vulnerability silently undermines supply-chain integrity for any application, container engine, or CI/CD pipeline relying on digest pinning. Attackers can substitute arbitrary manifests—modifying image layers, configuration payloads, or execution entrypoints—resulting in the execution of unauthorized or malicious code across downstream consumers and poisoned local mirrors.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
