Insecure Hostname Validation Allows HTTP Downgrade Attack

Summary

The isInternalHost() function in RequestScheme.swift uses insecure string prefix matching to determine whether a registry host should use HTTP or HTTPS. An attacker can craft hostnames (e.g., localhost.evil.com) that bypass this check, causing the client to send registry credentials over unencrypted HTTP connections.

Impact

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This affects:

• Registry login operations (username/password)
• Image pull/push operations with authenticated registries
• Any registry interaction using the default --scheme auto setting

Bypass patterns include any hostname starting with:

• localhost (e.g., localhost.evil.com)
• 127. (e.g., 127.evil.com)
• 192.168. (e.g., 192.168.evil.com)
• 10. (e.g., 10.evil.com)
• 172.16. through 172.31. (e.g., 172.16.evil.com)