The usage of HTTPS is not enforced here. As it is possible for the HTTP client to follow redirects, such redirects might lead to websites using HTTP.

As HTTP is a clear-text protocol, it is considered insecure. Due to its lack of encryption, attackers that are able to sniff traffic from the network can read, modify, or corrupt the transported content. Therefore, allowing redirects to HTTP can lead to several risks:

• Exposure of sensitive data
• Malware-infected software updates or installers
• Corruption of critical information

Even in isolated networks, such as segmented cloud or offline environments, it is important to ensure the usage of HTTPS. If not, then insider threats with access to these environments might still be able to monitor or tamper with communications.

Ask Yourself Whether

• It is possible for the requested resource to be redirected to an insecure location in the future.

There is a risk if you answered yes to the question.

Recommended Secure Coding Practices

• Ensure that the HTTP client only accepts HTTPS pages. In curl, this can be enabled using the option --proto "=https".
• If it is not necessary to follow HTTP redirects, then disable this in the HTTP client. In curl, this is done by omitting the -L or --location option.

Noncompliant Code Example

In this example, an install script is downloaded using curl and then executed.

Several options are set to ensure secure execution of the HTTP request using curl. However, as the option -L is set, https://might-redirect.example.com/install.sh might redirect curl to a location that uses HTTP. If this is the case, an attacker can change the install script that will be executed on the host system.

FROM ubuntu:22.04

# Sensitive
RUN curl --tlsv1.2 -sSf -L https://might-redirect.example.com/install.sh | sh

Compliant Solution

By adding the option --proto "=https" to the HTTP request, curl will only execute requests made using HTTPS. If a redirect goes to an insecure (HTTP) location, the request will not be executed. This ensures that no tampering can occur.

FROM ubuntu:22.04

RUN curl --proto "=https" --tlsv1.2 -sSf -L https://might-redirect.example.com/install.sh | sh

See

• MITRE, CWE-757 - Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
• curl.1 the man page - --proto <protocols>
• SSL and TLS Deployment Best Practices - Encrypt Everything