Vulnerabilities that can be exploited
**1. Hardcoded Credentials (Password Protected Docs):**
* **Vulnerability:**
* The `docker run` command for password-protected docs directly exposes the username (`user`) and password (`readytoraac`) as environment variables.
* Anyone with access to the Docker command history or the environment of the running container can easily retrieve these credentials.
* **Impact:**
* Unauthorized access to the protected documentation.
* Potential for further exploitation if these credentials are reused elsewhere.
* **Exploitation:**
* Simply by running `docker inspect <container_id> | grep NGINX_PASS` or `docker inspect <container_id> | grep NGINX_USER` an attacker can retrieve the credentials if they have access to the server the docker container is running on.
* If the server is compromised, an attacker can also read the environmental variables.
* **Remediation:**
* **Never** hardcode credentials in Docker run commands.
* Use Docker secrets or a dedicated secrets management solution (e.g., AWS Secrets Manager, HashiCorp Vault) to securely store and retrieve credentials.
* Use environmental variables that are passed into the docker run command, rather than being hardcoded.
**2. Lack of HTTPS (Potential):**
* **Vulnerability:**
* The provided code snippets don't explicitly show the use of HTTPS.
* If the Docsify server is served over HTTP, sensitive information (including authentication credentials, if not properly secured) could be intercepted by attackers on the network.
* **Impact:**
* Man-in-the-middle attacks.
* Data interception.
* **Exploitation:**
* Network sniffing.
* Proxying.
* **Remediation:**
* Always enforce HTTPS for web applications, especially those containing sensitive information.
* Use a reverse proxy (like Nginx or Apache) to handle SSL/TLS termination.
* Amplify should be configured to use HTTPS.
**3. Docker Image Security:**
* **Vulnerability:**
* The Dockerfiles themselves are not provided, making it impossible to assess their security.
* Potential vulnerabilities include:
* Running as root inside the container.
* Installing unnecessary packages.
* Using outdated base images.
* Not using a .dockerignore file.
* **Impact:**
* Container escape.
* Privilege escalation.
* Compromised host system.
* **Exploitation:**
* Depends on the specific vulnerabilities in the Dockerfiles.
* **Remediation:**
* Follow Docker security best practices:
* Use minimal base images.
* Run as a non-root user.
* Regularly update packages.
* Use a `.dockerignore` file.
* Scan docker images for vulnerabilities.
**4. Exposed Docker Port:**
* **Vulnerability:**
* The `docker run -p 3000:3000` and `docker run -p 8080:80` commands expose the ports directly to the host system.
* If the host system is publicly accessible, the Docsify server will be exposed to the internet.
* **Impact:**
* Unauthorized access to the Docsify server.
* Potential for attacks against the underlying operating system.
* **Exploitation:**
* Directly accessing the exposed ports.
* Port scanning.
* **Remediation:**
* Use a firewall to restrict access to the exposed ports.
* Consider using a reverse proxy to handle access control.
* If possible, run the docker container on a private network.
**5. Amplify Configuration (amplify.yml):**
* **Vulnerability:**
* The `amplify.yml` file is not shown.
* Potential vulnerabilities include:
* Incorrect build settings.
* Exposed environment variables.
* Lack of proper access control.
* **Impact:**
* Build failures.
* Data exposure.
* Unauthorized access.
* **Exploitation:**
* Depends on the specific vulnerabilities in the `amplify.yml` file.
* **Remediation:**
* Review the `amplify.yml` file for security best practices.
* Use environment variables securely.
* Implement proper access control.
**6. ECR Permissions:**
* **Vulnerability:**
* The ECR repository policy is not shown.
* Potential vulnerabilities include:
* Overly permissive access to the repository.
* Publicly accessible images.
* **Impact:**
* Unauthorized access to the Docker images.
* Potential for malicious image replacement.
* **Exploitation:**
* Depends on the specific permissions in the ECR repository policy.
* **Remediation:**
* Implement least privilege access to the ECR repository.
* Ensure that images are not publicly accessible unless intended.
**In summary:** The most critical vulnerability is the hardcoded credentials. Always prioritize secure secrets management. Also, ensuring HTTPS and reviewing the Dockerfiles and Amplify configuration are very important.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.