A security engineer inspects an internal build host and discovers that an unencrypted container management daemon is listening on TCP port 2375 across all network interfaces, as shown in the following output:
# netstat -tuln | grep 2375
tcp 0 0 0.0.0.0:2375 0.0.0.0:* LISTEN
This configuration allows any node on the internal network segment to send remote commands to spawn root-privileged container processes and access the underlying host filesystem. Which of the following represents the primary host and architecture vulnerability in this scenario?
- Exposition of an unauthenticated management control socket bound to a wild-card interfaceCevap
- BReliance on edge firewall perimeter security rather than disabling local host daemon services
- CUnsanitized SQL input parameters within the containerized web application database service
- DMisclassification of the container engine runtime as a detective security control
Cevap
Exposition of an unauthenticated management control socket bound to a wild-card interface
Binding an unauthenticated management control service (such as a container daemon API on port 2375) to a wildcard interface (0.0.0.0) allows any machine on the network segment to issue administrative calls, granting full host privilege escalation and control.
Adım Adım Çözüm
Anahtar Kavram
Host and Infrastructure Vulnerabilities: Unauthenticated Remote Management Interfaces
Tahmini Süre:1m 30s