HighExposed servicesBLWK-DEV-009

Docker's API is open to every program on this computer (‹path›)

What this means

‹path› opens the Docker API on ‹detail› with no authentication. Any program running as any user on this computer — a malicious package's install script, another account — can start a container with this machine's disk mounted and become root here. (An API reachable from the network is reported separately, from the open port.)

How to fix it

Remove the tcp:// entry from daemon.json (or untick Expose daemon on tcp://localhost:2375 without TLS in Docker Desktop → Settings → General) and use the default socket. For remote access use ssh://user@host as the Docker host, or TLS with client certificates on port 2376.

Check it yourself

Run a scan and look for BLWK-DEV-009 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "docker" and docker_api_unprotected == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1610
• MITRE ATT&CK T1133

Related checks

• A VNC/remote-desktop port is listening · BLWK-NET-001
• A port commonly used by ngrok's local API is listening · BLWK-NET-002
• A database or development service is open to the network (port ‹port›) · BLWK-NET-003
• No host firewall is filtering incoming connections · BLWK-NET-004
• A database or development service listens on all interfaces (port ‹port›, default-deny firewall) · BLWK-NET-005