T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:483
- Finding
- Unauthenticated Docker API Exposed on All Network Interfaces## Vulnerability Details **File Location**: `SKILL.md:483-486` **Vulnerability Type**: Unauthenticated remote Docker daemon exposure **Risk Level**: High **Vulnerable Code:** ```text # Container can't reach host # Use host.docker.internal (Docker Desktop) or host IP # On Linux: add to /etc/docker/daemon.json: # {"hosts": ["tcp://0.0.0.0:2375", "unix:///var/run/docker.sock"]} ``` ### Technical Analysis The Skill recommends configuring Docker to listen on plaintext TCP port 2375 on `0.0.0.0`, which makes the Docker API available through every host network interface. The configuration does not enable TLS, client authentication, authorization, or network-level restrictions. Access to the Docker daemon is effectively equivalent to root-level host access. A client that can reach this endpoint can instruct Docker to create a privileged container, mount sensitive host directories, access container secrets, manipulate existing workloads, or execute commands affecting the host. This configuration is also unnecessary for the stated objective of allowing a container to communicate with a service on the host. ### Attack Path 1. A user or Agent follows the Skill and adds the recommended `tcp://0.0.0.0:2375` listener to `/etc/docker/daemon.json`. 2. Docker is restarted or reloaded, exposing its unauthenticated API to all reachable networks. 3. An attacker scans for or otherwise discovers TCP port 2375. 4. The attacker calls the Docker API without credentials. 5. The attacker creates a privileged container or mounts the host root filesystem into a controlled container. 6. The attacker reads or modifies host files, executes host-level commands, steals credentials, disrupts workloads, or establishes persistence. ### Impact Assessment A reachable attacker may obtain effective root-equivalent control over the Docker host. The affected scope includes all containers, images, networks, volumes, mounted secrets, and potentially the ...[truncated 189 chars]
- Remediation
- ## Remediation Suggestions - Remove the recommendation to bind an unauthenticated Docker endpoint to `0.0.0.0:2375`. - For container-to-host communication, prefer `host.docker.internal`. On Linux, use Docker's `host-gateway` mapping where appropriate: ```bash docker run --add-host=host.docker.internal:host-gateway ... ``` - Alternatively, expose only the required host service on a narrowly scoped interface or dedicated Docker network. - If remote Docker API access is operationally required: - Bind it only to a trusted management interface. - Require mutual TLS and validate client certificates. - Restrict access with host and perimeter firewall rules. - Place an authorization proxy in front of the daemon where feasible. - Monitor and alert on Docker API access. - Explicitly warn that unauthenticated port 2375 must never be exposed to an untrusted network.