This page describes a highlighted problem produced by the Docker and Kubernetes Security scanner plugin.
You could find more details on the internal page: Cloud (IaC) Security plugin
If this project has been helpful to you, please consider giving it a ⭐ on GitHub to help others discover it.
Why curl bashing could be a problem?
Using curl or wget with a pipe (|) or redirection (>) to execute scripts directly poses a security risk. This practice, often referred to as curl | bash, should be approached with caution to avoid potential vulnerabilities. Piping the output of curl or wget directly to a shell runs untrusted scripts without review. This practice can lead to the execution of malicious code in your container. It is safer to download and verify the script before executing it.
Solution
Download the script to a file, verify its integrity, and then execute it. Avoid piping curl or wget output directly to the shell.
Problematic code
FROM ubuntu:20.04
USER nobody
RUN curl -sSL http://example.com/script.sh | shVerified code
FROM ubuntu:20.04
USER nobody
RUN curl -sSL http://example.com/script.sh -o script.sh
# run only if downloaded script was verified