Dockerfile Node.js certificate validation is disabled with the NODE_TLS_REJECT_UNAUTHORIZED environm

Rule Details

Cortex AppSec Rule ID	APPSEC2_DOCKER_6
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	HIGH
Framework	DOCKER

Impact

Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to 0 within Dockerfiles for Node.js applications is a security risk. This setting instructs Node.js to bypass SSL/TLS certificate verification for outgoing HTTPS requests.

By disabling SSL/TLS certificate verification, Node.js applications are exposed to potential man-in-the-middle (MitM) attacks. Attackers can intercept, modify, or eavesdrop on the traffic between the Node.js application and an external server, potentially leading to data breaches or the injection of malicious code.

How to Fix

[source,go]

• ENV NODE_TLS_REJECT_UNAUTHORIZED=0 RUN npm install somepackage

---