trivy
trivy copied to clipboard
aquasecurity
Detect secrets in container environment variables
Scan container images for secrets present in the container environment variables.
Example Dockerfile with AWS secret:
FROM node:12.22.12-slim
ENV AWS_SECRET_ACCESS_KEY erHSKM98c+afa418tkewJRjsdaJMxuiSgOExample
I think we can expand the scope of this issue to "detect secrets in misconfiguration scanning"?
We already detect secrets in any file, so secrets in Dockerfile can be detected now. I guess this feature request means scanning secrets in the config of container images.
$ docker inspect golang:1.18.0 | jq '.[0].Config.Env'
[
"PATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"GOLANG_VERSION=1.18",
"GOPATH=/go"
]
What I meant with this issue was that trivy image does not discover the secret. Likewise, trivy config neither.
Some test that I did:
Having the following Dockerfile:
FROM node:12.22.12-slim
ENV AWS_SECRET_ACCESS_KEY erHSKM98c+afa418tkewJRjsdaJMxuiSgOExample
- trivy fs Dockerfile.env
Dockerfile.env (secrets)
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)
┌──────────┬───────────────────┬──────────┬─────────┬───────────────────────────────┐
│ Category │ Description │ Severity │ Line No │ Match │
├──────────┼───────────────────┼──────────┼─────────┼───────────────────────────────┤
│ AWS │ AWS Access Key ID │ CRITICAL │ 3 │ # ENV AWS_ACCESS_KEY_ID ***** │
└──────────┴───────────────────┴──────────┴─────────┴───────────────────────────────┘
- trivy config Dockerfile.env
Dockerfile.env (dockerfile)
Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
See https://avd.aquasec.com/misconfig/ds002
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
- trivy image --security-checks secret test_env
None
@knqyf263 are you planning to implement this feature in the near future?
related to issue: https://github.com/aquasecurity/trivy/issues/2676 If we would infer the dockerfile of an image, we could scan it for exposed secrets as well
The secret is also part of the image history, not just the configuration.
FYI: The image configuration includes history as well.