Benign container 106,680,361 installs Download

docker.io/grafana/tempo main-6ddb036-2111-1

Archive contains path traversal entries (zip slip)Shell command-substitution syntax

SHA-256dc02627201f91256644d005fc43c988206a43b0a25c4ba821b6ca76b1d9d4c52

URLoci://docker.io/grafana/tempo:main-6ddb036-2111-1

Evidence

Newline-delimited single-token wordlist mime.types · lines 23–38

23:18… ##############################################################
24
25application/1d-interleaved-parityfec
26application/3gpdash-qoe-report+xml
27application/3gpp-ims+xml
28application/3gppHal+json
29application/3gppHalForms+json
30application/A2L					a2l
31application/ace+cbor
32application/ace+json
33application/activemessage
34application/activity+json
35application/aif+cbor
36application/aif+json
37application/alto-cdni+json
38application/alto-cdnifilter+json …

multipart/form-data content type mime.types · lines 2049–2060

2049:13… teranges
2050multipart/digest
2051multipart/encrypted
2052multipart/example
2053multipart/form-data
2054multipart/header-set
2055multipart/mixed
⋯5 lines

References a Unix shell executable path profile · lines 1–34

1# /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
2# and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).
3
4if [ "$(id -u)" -eq 0 ]; then
5  PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
6else
7  PATH="/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
8fi
9export PATH
10
11if [ "${PS1-}" ]; then
12  if [ "${BASH-}" ] && [ "$BASH" != "/bin/sh" ]; then
13    # The file bash.bashrc already sets the default PS1.
14    # PS1='\h:\w\$ '
15    if [ -f /etc/bash.bashrc ]; then
16      . /etc/bash.bashrc
17    fi
18  else
⋯6 lines
25fi
26
27if [ -d /etc/profile.d ]; then
28  for i in /etc/profile.d/*.sh; do
29    if [ -r $i ]; then
30      . $i
31    fi
32  done
33  unset i
34fi

Process creation via fork syscall tempo · 0x98d0b–0x98ddb

⋯3 more rows
0x98d3b85800000004983c0084881cf00000800.....I...H......
0x98d4bb8380000000f054883f8007405894424.8.....H...t..D$
0x98d5b30c34889f44983fd0074264983f900740.H..I...t&I...t
0x98d6b20b8ba0000000f05498945404d896930 [email protected]
⋯7 more rows

References Kerberos RC4 or etype 23 encryption tempo · 0x439df19–0x439dfd9

⋯3 more rows
0x439df4900000000000000e9f63b04000000000f.........;......
0x439df5900000000000000f8f63b04000000000f.........;......
0x439df6900000000000000922e3a040000000009.........:......
⋯7 more rows

No evidence locations were recorded for this file. Raw result