Suspicious build-time RUN layer

ID

dockerfile_suspicious_run

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Vendor

Docker

Resource

RUN instruction

Tags

ASVS50:v13.1.1, attack-T1059, cwe-94, reachable, supply-chain

Description

A build-time RUN layer performs an operation that weakens the security posture of the resulting image:

  • World-writable / setuid permissions — chmod 777 (and equivalents such as 0777 or a+rwx) or setting the setuid/setgid bit (chmod 4755, chmod u+s). World-writable files let any process in the container modify them, and a setuid binary is a classic privilege-escalation foothold.

  • TLS verification disabled — fetching build inputs with curl -k / --insecure or wget --no-check-certificate. Pulling content over an unverified channel lets a man-in-the-middle substitute a malicious payload that is then baked into the image.

Bare sudo is intentionally not flagged: it is too common in legitimate Dockerfiles to be a useful signal. Overtly malicious RUN payloads (reverse shells, curl | sh, memory dumps) are covered separately by the malware command checkers.

Examples

FROM alpine:3.19

# World-writable / setuid permissions
RUN chmod 777 /opt/app (1)
RUN chmod u+s /usr/local/bin/tool (2)

# TLS verification disabled while fetching a build input
RUN curl -k https://example.com/install.sh -o install.sh (3)
RUN wget --no-check-certificate https://example.com/pkg.tar.gz (4)
1 World-writable directory: any process can tamper with its contents.
2 Setuid bit set on a binary: a privilege-escalation foothold.
3 curl -k disables certificate verification, enabling MITM substitution.
4 wget --no-check-certificate fetches the archive over an unverified channel.

Mitigation / Fix

  • Grant the least permission that works — avoid 777/a+rwx; prefer explicit owner/group with modes such as 0644 (files) or 0755 (executables), and drop the setuid/setgid bit unless it is strictly required.

  • Always verify TLS when fetching build inputs: remove -k/--insecure/--no-check-certificate. If a private CA is involved, install its certificate and let the default verification succeed.

  • Verify the integrity of downloaded artifacts (checksum or signature) before using them in later layers.

FROM alpine:3.19

RUN chmod 0755 /opt/app
RUN curl https://example.com/install.sh -o install.sh \
 && echo "<sha256>  install.sh" | sha256sum -c -