Add misconfiguration for mounting in secret in during build #1790
Conversation
|
Hi @commjoen sir, |
|
Files have been shared over Slack ^^, looking forward to the challenge implementation good sir! |
… in container properly
|
|
||
| Acme Inc., a rising star in the SaaS industry, prides itself on delivering cutting-edge AI analytics to its global clientele. However, amidst their rapid deployment cycles and growing customer base, a critical security oversight has come to light. | ||
|
|
||
| During their Docker Buildx process, a sensitive secret, meant to remain temporary and secure during the build phase, was accidentally embedded into the container's filesystem due to a misconfiguration. This secret, now accessible within the running container, poses a significant security risk if exploited. |
There was a problem hiding this comment.
@bendehaan and @Shubham-Patel07 : should we be more explicit that it is about the WrongSecrets container? Instead of acme.inc we might want to make it more explicit so people know what to look for?
| @@ -0,0 +1,30 @@ | |||
| This challenge can be solved using the following steps: | |||
|
|
|||
| - *Acme Inc.* has misconfigured their Docker Buildx process, leading to sensitive secrets being embedded in the container's filesystem. Your task is to uncover these vulnerabilities. | |||
There was a problem hiding this comment.
Can we maybe show 2 different paths for solutions:
- Show the secret from the docker-create script
- Show how to get the secret by an exec into the container (using source code and env var to find the location)
|
Great progress @Shubham-Patel07 ! Can you please extend the set with the unit and integration tests please? |
What kind of changes does this PR include?
To Do
Relations
Closes #812
Checklist: