Description

CVE-2024-35192 is a vulnerability in Trivy, a security scanner. It allows malicious actors to trigger Trivy to scan container images from a crafted malicious registry, resulting in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access.

Key Insights

• The SVRS of 30 indicates a moderate risk, highlighting the need for attention and monitoring.
• This vulnerability can lead to the compromise of sensitive credentials, potentially allowing attackers to gain access to and manipulate container images.
• The vulnerability only affects systems where the default credential provider chain can obtain valid credentials.
• Active exploits have not been published, but the vulnerability is actively exploited in the wild.

Mitigation Strategies

• Update Trivy to version 0.51.2 or later.
• Review and restrict access to container registries.
• Implement strong credential management practices.
• Monitor for suspicious activity and unauthorized access to container registries.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.