Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a WWW-Authenticate header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint.
Fix: Default to anonymous auth for OCI pulls
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting this issue.
Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a
WWW-Authenticateheader redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint.Fix: Default to anonymous auth for OCI pulls
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting this issue.