Description

Detects use of sshpass with hardcoded passwords in Docker configurations. This is a security risk since it exposes plaintext SSH credentials in container definitions, which could be used by attackers to gain unauthorized access to systems.

Detection Strategy

• Check each line of Docker configuration files for use of the 'sshpass' command with '-p' flag followed by a plaintext password

• Line must not be commented out (not starting with #)

• The password must be directly specified rather than using a variable (not using $)

Vulnerable code example

FROM ubuntu:20.04
RUN apt-get update
# SECURITY ISSUE: Hardcoded credentials in SSH command expose sensitive information
RUN sshpass -p mySecretPass123! ssh user@example.com

✅ Secure code example

FROM ubuntu:20.04@sha256:f2034e7195f61334e6caff6ecf2e908c7f76feae4e47f973ee22af015e8b6724

ARG SSH_PASSWORD  # Password provided at build time
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends sshpass \
    && rm -rf /var/lib/apt/lists/*  # Clean up to reduce image size
...