Container Escape in Echo Go

In an Echo Go application, a container escape typically arises when the service runs with elevated privileges or exposes the host’s Docker socket, allowing an attacker to break out of the container and execute arbitrary code on the host. A common vulnerable pattern is an unauthenticated Echo route that accepts user‑supplied input and passes it directly to os/exec.Command to run Docker commands. If the container is started with --privileged or has /var/run/docker.sock mounted, the attacker can craft a request that runs a new container with a host‑mounted filesystem, effectively escaping the sandbox.

package main

import (
	"github.com/labstack/echo/v4"
	"os/exec"
)

func main() {
	e := echo.New()
	// Dangerous: executes arbitrary Docker CLI commands from user input
	e.POST("/docker/cmd", func(c echo.Context) error {
		cmd := c.FormValue("command") // e.g., "run -v /:/host alpine sh"
		out, err := exec.Command("docker", cmd).CombinedOutput()
		if err != nil {
			return c.String(500, string(out))
		}
		return c.String(200, string(out))
	})
	e.Start(":8080")
}

This code mirrors real‑world weaknesses exploited in CVEs such as CVE‑2019‑5736 (runc breakout) and CVE‑2020‑14386 (Dirty Sock), where command injection combined with a privileged container leads to host compromise.

middleBrick performs unauthenticated, black‑box scanning and looks for behavioral indicators that suggest a container escape vector. When scanning an Echo Go API, it:

• Attempts to reach common Docker‑socket‑exposed endpoints (e.g., GET /docker/version, GET /containers/json) by probing paths that Echo often mounts under a /docker prefix.
• Checks for command‑injection signatures: it sends payloads with shell metacharacters (;, &&, |) to POST/PUT endpoints that accept string parameters and looks for error messages or output that reveals command execution.
• Correlates findings with the presence of privileged‑container hints in HTTP response headers (e.g., Server: Docker) or with OpenAPI specs that define x‑docker‑socket extensions.

Example of using the middleBrick CLI to scan an Echo Go service:

middlebrick scan https://api.example.com

The scan completes in 5‑15 seconds, returns a risk score (A‑F), and highlights any detected container‑escape‑related findings under the "Input Validation" and "Privilege Escalation" categories, complete with severity ratings and remediation guidance.

Fixing container‑escape risks in Echo Go involves removing the privileged execution path, validating and restricting user input, and ensuring the container runs with minimal capabilities. Apply the following Echo‑centric practices:

• Never mount /var/run/docker.sock inside the container unless absolutely required, and if needed, protect it with authentication middleware.
• Drop Linux capabilities and run the container as a non‑root user (e.g., docker run --cap-drop ALL --user 1000:1000).
• Implement an Echo middleware that validates incoming commands against an allowlist before invoking os/exec.
• Use context.WithTimeout> to bound execution time and prevent resource exhaustion.

package main

import (
	"github.com/labstack/echo/v4"
	"os/exec"
	"strings"
)

var allowed = map[string]bool{
	"ps":   true,
	"images": true,
	"version": true,
}

func isAllowed(cmd string) bool {
	parts := strings.Fields(cmd)
	if len(parts) == 0 {
		return false
	}
	return allowed[parts[0]]
}

func dockerHandler(c echo.Context) error {
	raw := c.FormValue("command")
	// Reject any shell metacharacters
	if strings.ContainsAny(raw, ";&|$`\\\n\r") {
		return c.String(400, "Invalid characters in command")
	}
	if !isAllowed(raw) {
		return c.String(400, "Command not allowed")
	}
	out, err := exec.Command("docker", raw).CombinedOutput()
	if err != nil {
		return c.String(500, string(out))
	}
	return c.String(200, string(out))
}

func main() {
	e := echo.New()
	e.POST("/docker/cmd", dockerHandler)
	e.Start(":8080")
}

Deploy the container with a non‑privileged profile, for example:
docker run -d \
	--name echo-go-api \
	--cap-drop ALL \
	--user 1000:1000 \
	-p 8080:8080 \
	myechoimage

After applying these fixes, re‑run middleBrick; the scanner should no longer report container‑escape‑related findings, and the security score will improve accordingly.