T08 · Insecure Dependencies
Warning
- Location
scripts/backup_langfuse.sh:58- Finding
Unpinned Docker Image May Retrieve and Execute Unreviewed Code
- Content
View full analysis
/dev/null ``` ```bash # scripts/restore_langfuse.sh:125-128 docker run --rm \ -v "$MINIO_VOL":/data \ -v "$BACKUP_DIR":/backup:ro \ alpine sh -c "rm -rf /data/* && tar xzf /backup/minio-data.tar.gz -C /data" ``` ```yaml # SKILL.md:8-9 network: outbound: false reason: "Backs up local Docker volumes only. No data is sent to remote servers." ``` ### Technical Analysis Both scripts execute the mutable `alpine` image without specifying an immutable digest. If the image is not present locally, Docker can retrieve it from the configured registry. Consequently, the code that runs is not fully fixed by the reviewed project and may change when the registry tag is updated or if the registry configuration is compromised. This behavior also conflicts with the metadata assertion that outbound network access is not required. During backup, the container receives read access to the MinIO volume and write access to the backup directory. During restoration, it receives write access to the MinIO volume and read access to the selected backup directory. ### Attack Path 1. An attacker compromises or controls the Docker registry, registry mirror, DNS path, or local Docker image associated with the mutable `alpine` tag. 2. The expected image is absent locally, or the local mutable tag is replaced. 3. An operator executes the backup or restore script. 4. Docker retrieves or starts the attacker-controlled image. 5. The image reads sensitive MinIO content, modifies the backup, or corrupts the writable MinIO volum ...[truncated 478 chars]- Remediation
View remediation
`. - Preload and verify the image before executing either script. - Use `docker run --pull=never` so the operation fails rather than silently retrieving an image. - Document any required image retrieval accurately in `SKILL.md`. - Consider replacing the container dependency with trusted host utilities when practical. - Retain read-only mounts wherever possible and limit writable mounts to the narrowest required directory. ]]>