Dockerfile configuration disables strict SSL for NPM misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_12
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Setting the npm_config_strict_ssl environment variable to false within Dockerfiles is insecure. By doing so, you are instructing NPM (Node Package Manager) to bypass SSL certificate verification when interacting with registries or other network-based operations.

Disabling strict SSL for NPM can leave the container and its underlying applications susceptible to man-in-the-middle (MitM) attacks. In these attacks, malicious actors can intercept, modify, or eavesdrop on the traffic between the Node.js application and the NPM registry or other servers, leading to potential code injections or data leaks.

How to Fix

[source,go]

• ENV npm_config_strict_ssl=false
• ENV npm_config_strict_ssl=true

---