Skip to main content

Docker Token

A Docker token is a credential used to authenticate and authorize access to Docker services, such as Docker Hub or private Docker registries. These tokens are critical for managing container images, automating deployments, and integrating with CI/CD pipelines. Exposure of a Docker token can lead to unauthorized access to container images, potentially allowing attackers to inject malicious code or disrupt services.

How Does It Look​

Docker tokens can appear in various contexts, such as:

  • Environment variables:

    export DOCKER_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

  • Configuration files (JSON):

    {
      "auths": {
        "https://index.docker.io/v1/": {
          "auth": "dXNlcm5hbWU6ZXlKaGJHY2lPaUpTVXpJMU5pSXNJb..."
        }
      }
    }

  • Code snippets:

    import docker
    client = docker.from_env()
    client.login(username='user', password='eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...')

  • Connection strings:

    docker login -u user -p eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... https://index.docker.io/v1/

Severity​

  • 🔴 Critical

Docker tokens often provide extensive access to container registries, allowing for the manipulation of container images. This can lead to significant security risks, including the deployment of compromised containers across environments. The blast radius can be extensive, affecting multiple applications and services that rely on these containers.

What Can an Attacker Do?​

With immediate access to a Docker token, an attacker can perform several malicious actions:

  • Pull private images (if the token has read permissions), allowing them to inspect and reverse-engineer proprietary software.
  • Push malicious images (if the token has write permissions), potentially injecting malware into production environments.
  • Delete images (if delete permissions are granted), disrupting services that rely on those images.
  • Access sensitive metadata (if the token allows metadata access), which could be used for further attacks.

An attacker could also escalate their access by leveraging the compromised images to gain a foothold in other parts of the network, potentially leading to lateral movement and further exploitation.

Real-World Impact​

The exposure of a Docker token poses significant business risks, including:

  • Data Exposure: Proprietary code and configurations (if the token has read access to private images).
  • Financial Loss: Costs associated with downtime and incident response (if malicious images disrupt services).
  • Operational Disruption: Service outages or degraded performance (if critical images are deleted or replaced).
  • Reputational Damage: Loss of customer trust and brand integrity (if compromised images are deployed).

In the worst-case scenario, an attacker could use the compromised token to deploy widespread malware, leading to cascading failures across multiple systems and services.

Prerequisites for Exploitation​

To exploit a Docker token, an attacker needs:

  • Network access to the Docker registry or service.
  • Registry endpoint information to interact with the Docker API.
  • No IP restrictions or MFA enforcement on the account.

How to Verify If It's Active​

To verify if a Docker token is active, use the following command:

curl -H "Authorization: Bearer [TOKEN]" https://registry-1.docker.io/v2/

Valid credential response: A successful response will return a list of accessible repositories or a status code indicating successful authentication.

Invalid/expired credential response: An error message or status code indicating unauthorized access.

Detection Patterns​

Common Variable Names:

  • DOCKER_TOKEN
  • DOCKER_AUTH
  • DOCKER_PASSWORD
  • DOCKER_REGISTRY_TOKEN
  • DOCKER_LOGIN_TOKEN
  • DOCKER_SECRET

File Locations:

  • ~/.docker/config.json
  • /etc/docker/daemon.json
  • docker-compose.yml
  • .env

Regex Pattern:

"eyJ[a-zA-Z0-9-_]{20,}\.[a-zA-Z0-9-_]{20,}\.[a-zA-Z0-9-_]{20,}"

Remediation Steps​

  1. Revoke immediately - Go to Docker Hub > Account Settings > Security and delete the compromised token.
  2. Audit access logs - Review Docker Hub activity logs for unauthorized image pulls or pushes during the exposure window.
  3. Assess blast radius - Identify all systems, applications, and environments that used the exposed token.
  4. Rotate credential - Generate a new token in Docker Hub with least-privilege permissions.
  5. Update dependent systems - Deploy the new token to all applications and update CI/CD pipelines securely.
  6. Harden access controls - Enable IP allowlisting in Docker Hub and require two-factor authentication.
  7. Implement secrets management - Migrate tokens to a secrets manager (HashiCorp Vault, AWS Secrets Manager) to prevent hardcoding.
  8. Add detection controls - Set up pre-commit hooks and repository scanning to catch token leaks before they reach production.

Credential exposures often go undetected for extended periods, increasing the window for exploitation. As a long-term strategy, plan to establish an internal process or engage an external vendor for continuous external exposure monitoring. This helps identify leaked secrets across public repositories, paste sites, dark web forums, and other external sources before attackers can leverage them. Proactive detection and rapid response are essential to minimizing the impact of credential leaks.

References​