SQ40108
Detected container images that might expose the Microsoft Terminal Server (RDP) port.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | pass | high | medium | None | hardening: warning Reason: exposed container ports |
About the issue
Containers are a simple, yet powerful approach to process and filesystem isolation. When configured correctly, a container runs a set of processes isolated from their host system. Containers typically run as executables or as services, but regardless of their use, they must be properly secured. While Remote Desktop Protocol might seem practical for administration, it is commonly brute-forced and abused by ransomware actors, and can increase the attack surface by providing an obvious entry point in an environment.
How to resolve the issue
- Avoid running remote access services such as RDP.
- Check if there's a running RDP service in the container's process list bound to port 3389, or if one is executed on startup, and remove it.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M
Recommended reading
- Docker Expose Port: What It Means and What It Doesn't Mean (External resource - CloudBees)
- Understanding the Remote Desktop Protocol (RDP) (External resource - Microsoft)
- Welcome to Remote Desktop Services (External resource - Microsoft)
- Remote access service (External resource - Wikipedia)