Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A critical flaw in Docker Hub, the platform used for publishing and downloading container images, allowed users to manipulate images as if they were another user. This vulnerability was particularly concerning as it enabled unauthorized access to push, pull, or delete images. Docker addressed and fixed the flaw on September 30, 2023, and assured users that there was no evidence of exploitation during the period the flaw was active. The flaw originated from a feature that allowed personal accounts to be converted into organizations. During this conversion, personal access tokens (PATs), which serve as password substitutes, were transferred to the designated organization's owner. This transfer inadvertently granted the new owner the same access rights as the original account holder, posing a significant security risk. Despite the severity of the flaw, its impact was confined to the registry and did not extend to the Docker Hub web interface. This meant that critical account settings such as passwords, email addresses, and two-factor authentication remained secure. Docker classified the flaw as critical, assigning it a CVSS 4.0 score of 9.4, indicating its potential impact on security. The vulnerability was present from August 26, 2024, until its resolution in 2023, spanning over two years. The fix was implemented directly on Docker Hub, eliminating the need for users to install updates. The flaw's exploitation involved creating a token on a controlled account, converting it to an organization, and assigning another user as the owner, thereby granting unauthorized access. Docker's investigation revealed that the flaw was not exploited maliciously. They reviewed account conversions and registry logs, focusing on any token used under multiple identities. The analysis showed that most pushes were legitimate, with no evidence of malware or tampering in public images. To address the issue, Docker notified affected users and deactivated transferred tokens. Users were advised to review their tokens, revoke any unrecognized ones, and use organization access tokens for automation tasks. Docker also updated its procedures to require consent before naming a user as an organization owner and to notify users of such changes. Docker's documentation had previously described the token transfer process, but this was removed following the flaw's resolution. Moving forward, Docker has implemented measures to ensure transparency and security, including recording changes in token ownership and reviewing features that alter credential ownership.