@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

The vulnerability in @cyclonedx/cdxgen arises from its Docker registry authentication logic, which uses substring matching to select credentials from the Docker config file. Specifically, when building the X-Registry-Auth header for Docker API requests, the code checks if the configured registry key includes the requested registry hostname as a substring, which is not a secure origin check. For example, credentials for 'private-registry.example.com' are incorrectly matched and forwarded when pulling images from 'registry.example.com' because the former includes the latter as a substring. This leads to private registry credentials being sent to a different registry, potentially exposing sensitive authentication data. The issue affects versions from 9.9.5 up to but excluding 12.3.3. A fix has been implemented by adding strict host matching functions to prevent this substring-based misbinding.

This vulnerability can cause private Docker registry credentials to be sent to a different registry during image pulls, potentially exposing sensitive credentials to unauthorized parties. An attacker controlling or observing the target registry can induce a victim to scan images from that registry, causing the victim's private registry credentials to be forwarded in the Docker API request. This credential forwarding undermines the confidentiality of private registry credentials and can lead to unauthorized access if those credentials are intercepted or misused.

An official fix is available and has been implemented in @cyclonedx/cdxgen by introducing strict host matching to replace the insecure substring matching logic. Users should upgrade to version 12.3.3 or later to remediate this vulnerability. Until upgraded, users should be aware of the risk of credential misbinding when scanning images from registries with hostnames that are substrings of private registries. No other mitigations are specifically recommended by the vendor advisory.