T08 · Insecure Dependencies
Warning
- Location
- commands.md:21
- Finding
- Mutable Third-Party Container Image Reference## Vulnerability Details **File Location**: `commands.md:21` **Vulnerability Type**: Unpinned third-party container image **Risk Level**: Medium **Vulnerable Code**: ```bash docker pull nginx:alpine # fetch ``` ### Technical Analysis The command pulls the third-party `nginx` image through the mutable `alpine` tag without specifying a fixed version or verified digest. A mutable tag can resolve to different image contents over time. This undermines image provenance and deployment reproducibility and contradicts the project's own image-pinning guidance. Although using the official NGINX repository reduces risk compared with an unknown publisher, the command does not cryptographically bind the downloaded artifact to content reviewed or approved by the user. Changes made by the publisher, accidental tag replacement, or registry or publisher compromise could cause a subsequent pull to retrieve unexpected image content. ### Attack Path 1. The `nginx:alpine` tag is updated, replaced, or compromised at its registry. 2. A user follows the documented command and pulls the mutable tag. 3. Docker downloads the image currently associated with that tag rather than a previously reviewed artifact. 4. The user starts or deploys a container based on the downloaded image. 5. Any malicious or vulnerable content in the substituted image executes with the container's configured permissions and access. ### Impact Assessment Exploitation requires control over or compromise of the image publication path, or an unsafe upstream image update. Successful exploitation could execute arbitrary code inside the resulting container. The accessible scope would depend on its runtime configuration, including mounted volumes, network access, Linux capabilities, secrets, and access to the Docker socket. This finding does not independently grant host privileges, but an overly privileged runtime configuration could substantially increase ...[truncated 11 chars]
- Remediation
- ## Remediation Suggestions - Replace the mutable tag with an approved, explicit image version. - For security-sensitive or production use, pin the image by a verified SHA-256 digest, for example: ```bash docker pull nginx:1.27.4-alpine@sha256:<verified-digest> ``` - Obtain the digest from a trusted registry and verify the publisher and image provenance before approval. - Use automated image scanning and signature or attestation verification in CI. - Establish a controlled process for reviewing and updating pinned digests so security patches can be adopted without silently changing deployed artifacts.