T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/run_docker_cli.sh:24- Finding
Automatic Retrieval and Execution of a Mutable Remote Container Image
- Content
View full analysis
&2 exit 1 ;; esac if [ -z "${IMAGE_NAME:-}" ] && [ -n "${IMAGE_REGISTRY}" ]; then IMAGE_NAME="${IMAGE_REGISTRY}/${IMAGE_BASENAME}:${IMAGE_VERSION}" elif [ -z "${IMAGE_NAME:-}" ]; then IMAGE_NAME="${IMAGE_BASENAME}:${IMAGE_VERSION}" fi if [ -f "${ENV_FILE}" ]; then DOCKER_ARGS+=(--env-file "${ENV_FILE}") fi for env_name in VL_BASE_URL VL_API_KEY VL_MODEL VL_API_TIMEOUT VL_PAGE_TARGET_WIDTH VL_PAGE_MIN_ZOOM VL_PAGE_MAX_ZOOM; do if [ -n "${!env_name:-}" ]; then DOCKER_ARGS+=(-e "${env_name}=${!env_name}") fi done if ! docker image inspect "${IMAGE_NAME}" >/dev/null 2>&1; then docker pull "${IMAGE_NAME}" >/dev/null fi shift input_path="$1" input_dir="$(cd "$(dirname "${input_path}")" && pwd -P)" input_name="$(basename "${input_path}")" input_path="${input_dir}/${input_name}" input_dir="$(dirname "${input_path}")" shift exec docker "${DOCKER_ARGS[@]}" \ -v "${input_dir}:/input:ro" \ "${IMAGE_NAME}" \ file "/input/${input_name}" "$@" ``` ### Technical Analysis The wrapper obtains a prebuilt container image from a personal third-party Aliyun registry and immediately executes it. The image is identified by the mutable tag `0.0.1`, rather than an immutable content digest such as `sha256:...`. No signature, digest, provenance, or expected image identity is verified before execution. A registry administrator, c ...[truncated 2311 chars]- Remediation
View remediation