Trivy Supply Chain Attack - Compromised Docker Images Found

The Threat

A significant supply chain attack has emerged, targeting Trivy, a widely used open-source vulnerability scanner. Initially identified as a compromise of the GitHub Actions repository, the attack has now escalated to include malicious Docker images published on Docker Hub. This incident poses a serious risk to developers and organizations relying on Trivy for scanning vulnerabilities in their container images and code repositories.

The attackers managed to publish three compromised Docker image versions, specifically 0.69.4, 0.69.5, and 0.69.6, which were made publicly accessible. These images were not just ordinary uploads; they contained indicators of compromise linked to the TeamPCP infostealer. This malware is designed to exfiltrate sensitive information, making the attack particularly dangerous for those who unknowingly integrate these images into their CI/CD pipelines.

Who's Behind It

The attack appears to be the work of a well-organized group, leveraging the trust that developers place in Trivy. The Aqua Security GitHub organization was briefly exposed during the attack, suggesting that the attackers gained considerable access. The compromised images were pushed to Docker Hub without any corresponding GitHub releases, raising alarms about the integrity of the release process.

Security researchers from Socket.dev have been instrumental in identifying these compromised images. They noted that the malicious tags were published without following the standard practices that developers rely on for verification. This highlights a significant gap in security that attackers exploited, allowing them to slip malicious code into widely used tools.

Tactics & Techniques

The method of infection is particularly concerning. Docker Hub allows tags to be updated silently, meaning that a tag like latest can point to a different image without any visible warning. This means organizations that automatically pull the latest version of Trivy for scanning could inadvertently download a compromised image.

The potential for widespread infection is high, as any CI/CD pipeline using affected versions during the attack window could have integrated the TeamPCP infostealer. This malware can stealthily exfiltrate environment variables, API secrets, and other critical data, posing a severe risk to organizational security.

Defensive Measures

Organizations using Trivy should take immediate action. First, they need to audit which image versions were pulled during the attack period. Any pipeline that utilized tags 0.69.4, 0.69.5, or 0.69.6 should be considered potentially compromised. It is crucial to rotate all secrets, tokens, and credentials accessible from those pipelines.

Reverting to version 0.69.3, the last known clean release, is strongly recommended. Additionally, organizations should enhance their security measures by verifying image digests before deployment rather than relying solely on tag names. Monitoring outbound network traffic for connections to the malicious domain can also help identify active compromises and mitigate risks.