T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/setup.sh:149
- Finding
- Unverified Remote Installation Scripts Are Piped Directly to Bash<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:149-163` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash NVM_VERSION="v0.40.3" # Three-tier fallback: official → Gitee mirror → error _nvm_install_official() { curl -fsSL --connect-timeout 15 \ "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" | bash } _nvm_install_gitee() { curl -fsSL --connect-timeout 15 \ "https://gitee.com/mirrors/nvm/raw/${NVM_VERSION}/install.sh" | bash } if run_with_spinner "Installing nvm (official)..." _nvm_install_official 2>/dev/null; then echo -e "[5/${TOTAL}] nvm installed (official source) ${GREEN}✅${NC}" elif run_with_spinner "Installing nvm (Gitee mirror)..." _nvm_install_gitee 2>/dev/null; then echo -e "[5/${TOTAL}] nvm installed (Gitee mirror) ${GREEN}✅${NC}" else fail "nvm installation failed, please check network connectivity." fi ``` ### Technical Analysis The setup process retrieves shell code from an external URL and immediately executes it using `bash`. Neither downloaded script is verified against an expected cryptographic digest or trusted signature before execution. Although `NVM_VERSION` is set to a specific tag, a tag or URL alone does not authenticate the returned content. The effective payload can change after the Skill has been audited if an upstream account, repository reference, mirror, DNS path, TLS trust chain, or hosting platform is compromised. The Gitee fallback creates an additional supply-chain trust boundary. A failure to contact the official source automatically causes code from the mirror to be executed without requiring separate user approval. ### Attack Path 1. An attacker compromises an upstream repository account, tag, mirror, hosting service, or relevant network trust path. 2. The attacker modifies the script returned for the configured NVM installation URL. 3. The user invokes the Skill on the mig ...[truncated 1002 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not pipe network responses directly into a shell. 2. Download the installer into a newly created private temporary directory: ```bash umask 077 tmp_dir="$(mktemp -d)" curl --proto '=https' --tlsv1.2 -fL \ -o "$tmp_dir/nvm-install.sh" \ "https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh" ``` 3. Verify the file against a hardcoded, reviewed SHA-256 digest or a valid upstream cryptographic signature obtained through an independent trust path. 4. Abort on any verification failure; do not silently fall back to another provider. 5. Execute the local file only after successful validation: ```bash printf '%s %s\n' "$EXPECTED_SHA256" "$tmp_dir/nvm-install.sh" | sha256sum -c - bash "$tmp_dir/nvm-install.sh" ``` 6. Remove the unauthenticated mirror fallback or require explicit user approval and an independently pinned digest for the mirror artifact. 7. Ensure unrestricted passwordless sudo has been removed before any externally obtained user-level installer is executed. ]]>