When downloading files over HTTPS, following redirects without enforcing the protocol can expose the transfer to a downgrade attack.

Why is this an issue?

HTTP is a clear-text protocol that provides no encryption, making communications vulnerable to interception and modification. When an HTTP client is configured to follow redirects, an initial HTTPS connection can be silently downgraded to HTTP if the server redirects to an insecure location. This rule detects curl commands that follow redirects using -L or --location without the --proto "=https" option, and wget commands that allow redirects without --max-redirect=0.

What is the potential impact?

Exposure of sensitive data

An attacker with access to network traffic can read the contents of the downloaded file, including any sensitive data it contains.

Supply chain compromise

Because a downgraded HTTP connection is unencrypted, an attacker in a position to intercept traffic can modify the downloaded file in transit. If the file is an install script or software package, injected malicious code will execute on the target system.

How to fix it in cURL

Code examples

The following command uses -L to follow redirects without restricting the protocol to HTTPS, allowing the connection to be silently downgraded.

Noncompliant code example

FROM ubuntu:22.04

# Noncompliant
RUN curl --tlsv1.2 -sSf -L https://might-redirect.example.com/install.sh -o install.sh

Compliant solution

Use --proto "=https" to ensure requests are only made using HTTPS. Any attempt to redirect to a location using HTTP will result in an error.

FROM ubuntu:22.04

RUN curl --proto "=https" --tlsv1.2 -sSf -L https://might-redirect.example.com/install.sh -o install.sh

If you expect the server to return the file without redirects, remove the -L or --location option instead.

FROM ubuntu:22.04

RUN curl --tlsv1.2 -sSf https://might-redirect.example.com/install.sh -o install.sh

How to fix it in Wget

Code examples

wget follows HTTP redirects by default without restricting the protocol, allowing the connection to be silently downgraded to HTTP. wget does not support restricting redirects to HTTPS, so curl should be used instead when redirects are expected.

Noncompliant code example

FROM ubuntu:22.04

# Noncompliant
RUN wget --secure-protocol=TLSv1_2 -q -O install.sh https://might-redirect.example.com/install.sh

Compliant solution

Use --max-redirect=0 to disable redirect following entirely.

FROM ubuntu:22.04

RUN wget --secure-protocol=TLSv1_2 --max-redirect=0 -q -O install.sh https://might-redirect.example.com/install.sh

Resources

Documentation

Articles & blog posts

Standards