We break down the primary attack vectors in containerized environments: exposed secrets, privilege misconfigurations, API compromise, and supply chain attacks.

Securelist is a cybersecurity blog and research platform operated by Kaspersky Lab. It offers insights, analysis, and reports on cybersecurity threats, vulnerabilities, and malware campaigns. Developers can learn about emerging cyber threats, security best practices, and mitigation strategies to protect their applications and systems. Additionally, Securelist provides insights into cybersecurity trends, threat intelligence, and industry developments, offering resources for cybersecurity professionals.

Securelist

A deep dive into the primary attack vectors targeting containerized environments, covering: exploitation of Linux kernel and runtime vulnerabilities (CVE-2019-5736, CVE-2022-0492, CVE-2024-21626), malicious activity inside compromised containers (secrets theft, credential harvesting), container escape techniques via dangerous Linux capabilities (CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_SYS_PTRACE, CAP_NET_ADMIN), abuse of orchestration APIs (exposed Docker daemon, Kubernetes API with weak RBAC), and supply chain attacks targeting Docker Hub images and CI/CD pipelines. Each vector is illustrated with concrete attack scenarios and PoC examples. The piece concludes that securing container infrastructure requires host protection, strict RBAC, capability minimization, and full supply chain validation.

Containers on fire: from container escapes to supply chain attacks