Hiding in Plain Sight - The Untold Story of Hidden Vulnerabilities

Vulnerability scanners and software composition analysis tools are widely used to flag vulnerable components, but their results often differ widely. Every scanner must first inventory the software in an environment, then match that inventory against security advisories, so a weakness in either step produces wrong answers.

The research benchmarked four commercial and two open-source scanners against twenty popular Docker Hub images. Agreement between tools was low, and even the best recall missed roughly one in ten known vulnerabilities. Root causes included uneven support for package formats and runtimes, ignored OS advisory context, and inconsistent vulnerability data. The central case was software placed into images outside the package manager through commands such as RUN with curl or wget, plus COPY, ADD and FROM. Examples included a MongoDB server, a Go binary and build helpers that scanners could not see. A live demo against two Apache httpd versions showed actively exploited path traversal flaws that the tested scanners missed, followed by live exploitation of each.

For image builders, these install patterns create blind spots and should be avoided or documented where possible. For practitioners, scanner output should not be taken at face value; tools should be evaluated against the languages and environments actually used, and extra controls such as pipeline checks should look for components installed outside package managers.