T08 · Insecure Dependencies
Warning
- Location
- scripts/backup_langfuse.sh:58
- Finding
- Unpinned Docker Image May Retrieve and Execute Unreviewed Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup_langfuse.sh:58-61`; `scripts/restore_langfuse.sh:125-128`; related network declaration at `SKILL.md:8-9` **Vulnerability Type**: Unpinned third-party container image **Risk Level**: Medium ### Vulnerable Code ```bash # scripts/backup_langfuse.sh:58-61 docker run --rm \ -v "$MINIO_VOL":/data:ro \ -v "$BACKUP_DIR":/backup \ alpine tar czf /backup/minio-data.tar.gz -C /data . 2>/dev/null ``` ```bash # scripts/restore_langfuse.sh:125-128 docker run --rm \ -v "$MINIO_VOL":/data \ -v "$BACKUP_DIR":/backup:ro \ alpine sh -c "rm -rf /data/* && tar xzf /backup/minio-data.tar.gz -C /data" ``` ```yaml # SKILL.md:8-9 network: outbound: false reason: "Backs up local Docker volumes only. No data is sent to remote servers." ``` ### Technical Analysis Both scripts execute the mutable `alpine` image without specifying an immutable digest. If the image is not present locally, Docker can retrieve it from the configured registry. Consequently, the code that runs is not fully fixed by the reviewed project and may change when the registry tag is updated or if the registry configuration is compromised. This behavior also conflicts with the metadata assertion that outbound network access is not required. During backup, the container receives read access to the MinIO volume and write access to the backup directory. During restoration, it receives write access to the MinIO volume and read access to the selected backup directory. ### Attack Path 1. An attacker compromises or controls the Docker registry, registry mirror, DNS path, or local Docker image associated with the mutable `alpine` tag. 2. The expected image is absent locally, or the local mutable tag is replaced. 3. An operator executes the backup or restore script. 4. Docker retrieves or starts the attacker-controlled image. 5. The image reads sensitive MinIO content, modifies the backup, or corrupts the writable MinIO volum ...[truncated 478 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the image to a reviewed immutable digest, for example `alpine@sha256:<verified-digest>`. - Preload and verify the image before executing either script. - Use `docker run --pull=never` so the operation fails rather than silently retrieving an image. - Document any required image retrieval accurately in `SKILL.md`. - Consider replacing the container dependency with trusted host utilities when practical. - Retain read-only mounts wherever possible and limit writable mounts to the narrowest required directory. ]]>