Certificate not verified by pipeline command

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_92
Category	Data Protection
Severity	MEDIUM

Impact

Not verifying certificates through pipeline commands allows attackers to plant their own certificate and impersonate a server in order to perform a man-in-the-middle attack to intercept, tamper with and/or steal information, to possibly run code in the build system and to reach the production environment.

Recommended Solution - Buildtime

Remove flags from the commands found in the pipeline that disable the certificate check:

• For wget command remove: --no-check-certificate
• For curl command remove: --insecure or -k flags

Consider removing the command entirely from the pipeline if the server certificate cannot be authenticated.