Technical impact
The docker_pull module incorrectly uses the realm value from a Docker registry’s WWW-Authenticate response header as the authentication endpoint without verifying it. An attacker positioned as a man‑in‑the‑middle between the BBOT tool and a registry can alter that header to point to any arbitrary URL, causing BBOT to redirect its authentication request. This can lead to the accidental transmission of authentication credentials to an attacker’s server, effectively leaking tokens. The vulnerability represents a server‑side request forgery (SSRF) scenario that compromises confidentiality of authentication data.
Affected Systems
The affected product is Black Lantern Security’s BBOT. No specific version information was provided by the CNA; therefore, any version of BBOT currently deployed may be vulnerable until a fix is applied.
Risk and Exploitability
The CVSS score of 3.1 indicates a low severity issue, and the EPSS score of less than 1% suggests that exploitation is unlikely under current conditions. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to control network traffic between BBOT and the registry, typically via a man‑in‑the‑middle attack. Because the impact is limited to possible token leakage and no privilege escalation or service interruption is described, the overall risk remains low, though it is significant if the leaked tokens provide privileged access to a registry or downstream services.
Github GHSA