| शीर्षक | FunnyWolf Viper <=3.1.11 Hard-coded Credentials |
|---|
| विवरण | The official `viperplatform/viper` Docker image (tag `latest`, image digest
`9513b84d3d5864c44ff59410e57980cc4f9f536ef16dca161f27d21a8b27c45d`)
ships a `.git` working directory of the `viperpython` source repository inside
the container filesystem. The embedded Git configuration
(`/root/viper/.git/config`) contains the plaintext remote URL of
`codeup.aliyun.com` with **embedded plaintext credentials**
(`https://<user>:<password>@codeup.aliyun.com/.../viperpython.git`).
Because the image is publicly pullable from Docker Hub, anyone who downloads
the image can extract the `.git/config` file and recover the plaintext
account credentials of a privileged developer account on Alibaba Cloud
Codeup (Yunxiao / 云效), which in turn grants read/write access
(access level 40 = Admin, role "管理员") to a whole set of private
repositories of the organization, as demonstrated by the researcher. |
|---|
| स्रोत | ⚠️ https://github.com/Randark-JMT/vulnerability-reports/blob/main/advisories/2026-09-02-viper-docker-git-credential-leak.md |
|---|
| उपयोगकर्ता | Randark (UID 100961) |
|---|
| सबमिशन | 02/09/2026 10:00 AM (1 महीना पहले) |
|---|
| संयम | 10/10/2026 05:54 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416236 [FunnyWolf Viper तक 3.1.11 /root/viper/.git/config कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|