Shellshock on Docker

Shellshock vulnerabilities in Docker environments typically arise from improper handling of environment variables in shell scripts executed during container startup or in entrypoint scripts. The classic Shellshock vulnerability (CVE-2014-6271) allows remote code execution when environment variables containing malicious code are passed to Bash through functions.

In Docker contexts, this manifests in several specific ways:

• ENTRYPOINT scripts that use Bash without proper validation of environment variables
• Dockerfile RUN commands that create temporary shell contexts vulnerable to injection
• Orchestration tools that pass environment variables from external sources without sanitization
• CI/CD pipelines that inject build arguments into container environments

The Docker-specific attack pattern often involves exploiting build-time arguments or runtime environment variables that are processed by Bash scripts. For example, a Dockerfile might contain:

FROM alpine:latest

# Vulnerable: environment variable passed to shell without validation
ARG SECRET_KEY
ENV SECRET_KEY=$SECRET_KEY

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

If entrypoint.sh processes SECRET_KEY without proper validation, an attacker could inject malicious code through build arguments or environment variables.

Another Docker-specific scenario occurs with multi-stage builds where environment variables from earlier stages persist unexpectedly. Consider:

FROM node:18 AS builder
ARG API_URL
ENV API_URL=$API_URL

# Malicious code could be injected via API_URL
RUN echo "Building with API: $API_URL"

FROM node:18-alpine
COPY --from=builder /app/dist ./dist

The persistence of environment variables across build stages creates attack surfaces unique to Docker's build process.

Detecting Shellshock vulnerabilities in Docker environments requires examining both container images and runtime configurations. middleBrick's Docker-specific scanning includes:

• Static analysis of Dockerfile contents for vulnerable patterns
• Runtime scanning of container entrypoints and scripts
• Environment variable validation during container startup
• Build-time argument analysis for potential injection points

Using middleBrick's CLI for Docker scanning:

# Scan a Dockerfile directly
middlebrick scan Dockerfile

# Scan a running container
middlebrick scan --container myapp_container

# Scan a Docker Compose service
middlebrick scan docker-compose.yml

Manual detection techniques include:

# Check for Bash usage in entrypoints
$ docker exec my_container cat /entrypoint.sh | grep -E 'bash|sh'

# Examine environment variables for suspicious content
$ docker exec my_container env | grep -E '(()|:|;|&)'

# Test for Shellshock vulnerability
$ env x='() { :;}; echo vulnerable' bash -c 'echo test'

Key indicators in Dockerfiles include:

middleBrick automatically flags these patterns and provides specific remediation guidance for each detected vulnerability.

Remediating Shellshock vulnerabilities in Docker environments requires both code changes and configuration updates. Here are Docker-specific fixes:

1. Dockerfile Hardening

# Use minimal shells instead of Bash where possible
FROM alpine:latest

# Replace Bash with BusyBox ash (no Shellshock vulnerability)
RUN apk add --no-cache busybox

# Use explicit validation for build arguments
ARG API_URL
RUN if [ -z "$API_URL" ] || [[ "$API_URL" =~ [^a-zA-Z0-9:/._-] ]]; then \
    echo "Invalid API_URL" && exit 1; \
fi
ENV API_URL=$API_URL

# Use shell-less ENTRYPOINT when possible
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

2. Secure Entrypoint Scripts

#!/bin/sh
# Secure entrypoint script

# Validate environment variables
set -eu

validate_env() {
    local var="$1"
    local value="${!var:-}"
    
    # Reject suspicious characters
    if echo "$value" | grep -q '[(){};|&$;]'; then
        echo "Invalid characters in $var: $value" >&2
        exit 1
    fi
}

# Validate all critical variables
for var in API_URL SECRET_KEY; do
    validate_env "$var"
done

# Safe execution
exec "$@"

3. Build-Time Security

# Use .dockerignore to prevent sensitive files from being included
*.sh
*.bash
*.zsh

# Use --build-arg only for validated inputs
docker build --build-arg API_URL=https://api.example.com -t myapp .

4. Runtime Protection

# Docker Compose security configuration
version: '3.8'
services:
  app:
    build: .
    environment:
      - API_URL=${API_URL:-https://default.api}
    # Restrict shell access
    security_opt:
      - no-new-privileges:true
    # Drop all capabilities
    cap_drop:
      - ALL
    # Add back only necessary capabilities
    cap_add:
      - CHOWN

middleBrick's Pro plan provides continuous monitoring that automatically scans updated Docker images and configurations, alerting you when new Shellshock vulnerabilities are introduced.