Dockerfile certificate validation is disabled with curl misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_2
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

This rule checks for the use of either the --insecure option or the -k shorthand with curl. Both these flags tell curl to skip verifying the server's certificate when making a request over HTTPS.

Bypasses SSL Verification: By using either --insecure or -k, you're telling curl to not validate the SSL certificate of the server it's connecting to. This makes the request vulnerable to man-in-the-middle (MitM) attacks, where an attacker can intercept and possibly modify the traffic between curl and the server.

How to Fix

Don't use the --insecure flag. [source,go]

• RUN curl --insecure https://example.com/somepackage.tar.gz | tar xz
• RUN curl https://example.com/somepackage.tar.gz | tar xz

---