T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/normal/scripts/alipay_cli_refresh.mjs:8
- Finding
- Mandatory Download and Direct Execution of an Unverified Remote Shell Installer<![CDATA[ ## Vulnerability Details **File Location**: `references/normal/scripts/alipay_cli_refresh.mjs:8-9, 94-121`; mandatory invocation is defined in `SKILL.md:27-35` **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: Critical ### Vulnerable Code ```javascript const installUrl = 'https://opengw.alipay.com/alipaycli/install'; const internalPrefix = 'ALIPAY_AIPAY_INTERNAL:'; ``` ```javascript const curl = spawnSync('curl', ['-fsSL', '--connect-timeout', '10', '--max-time', '60', installUrl], { encoding: 'utf8', env: cleanChildEnv(), maxBuffer: 30 * 1024 * 1024, shell: false, timeout }); if (curl.error || curl.status !== 0) { const output = commandOutput(curl); emit(isNetworkFailure(curl.status, output) ? 'RETRY_WITH_NETWORK' : 'FAILED'); return; } const installEnv = cleanChildEnv({ ALIPAY_CLI_BIN: binDir, ALIPAY_CLI_SKIP_VERIFY: 'true', PATH: `${binDir}${path.delimiter}${process.env.PATH || ''}` }); const bash = spawnSync('bash', [], { input: curl.stdout, encoding: 'utf8', env: installEnv, maxBuffer: 30 * 1024 * 1024, shell: false, timeout }); if (bash.error || bash.status !== 0) { const output = commandOutput(bash); if (isNetworkFailure(bash.status, output)) emit('RETRY_WITH_NETWORK'); else if (isPermissionFailure(output)) emit('RETRY_WITH_LOCAL_FS_PERMISSION'); else emit('FAILED'); return; } ``` The Skill launcher requires this refresh operation: ```text node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" env refresh-alipay-cli ``` ### Technical Analysis The refresh implementation downloads a shell program from a mutable external URL and immediately supplies the downloaded response to Bash. It does not verify a pinned artifact digest, detached digital signature, expected version, certificate/public-key pin, or transparency-log record before execution. HTTPS protects the connection in transit but does not establish that the returned script is the same payload that was re ...[truncated 2326 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove direct download-to-interpreter execution. Never pass an HTTP response directly to Bash. 2. Publish a versioned, immutable installer artifact rather than a mutable installer endpoint. 3. Pin the expected version and a cryptographic SHA-256 or stronger digest in reviewed Skill code. 4. Prefer detached signature verification using a pinned publisher key. Reject unsigned, expired, revoked, or mismatched artifacts. 5. Download to a private temporary file created with restrictive permissions, verify it, and only then execute it. 6. Do not set `ALIPAY_CLI_SKIP_VERIFY=true`; perform independent integrity and provenance verification before installation. 7. Require explicit user consent before installing or replacing local tools. Do not make refresh a mandatory Skill-loading side effect. 8. Install into a Skill-specific directory rather than the general `~/.local/bin` search path, and invoke the tool by an absolute verified path. 9. Verify more than `alipay-cli version`: validate the installed file’s digest, ownership, permissions, expected manifest, and signature. 10. Run installation with a minimized environment and restricted filesystem/network access where the host supports sandboxing. ]]>