T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:421
- Finding
- Unpinned Remote Installer Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:421-424` **Vulnerability Type**: Execution of mutable remote code without integrity verification **Risk Level**: High ### Vulnerable Code ```powershell # Windows (PowerShell as Admin) (Invoke-WebRequest -Uri 'https://api.controld.com/dl/rmm' -UseBasicParsing).Content | Set-Content "$env:TEMP\ctrld_install.ps1"; Invoke-Expression "& '$env:TEMP\ctrld_install.ps1' 'CODE'" ``` ```bash # macOS/Linux sh -c 'sh -c "$(curl -sSL https://api.controld.com/dl/rmm)" -s CODE' ``` ### Technical Analysis The documented deployment commands retrieve an installer from `https://api.controld.com/dl/rmm` and immediately execute the returned content. The downloaded payload is not tied to a fixed release, cryptographic digest, or verified digital signature. Consequently, the effective code executed by this skill workflow can change after the repository has been audited. HTTPS authenticates the server connection but does not establish that the returned script is a particular reviewed version. If the distribution endpoint, its hosting infrastructure, DNS resolution, TLS trust chain, or vendor release process is compromised, arbitrary replacement code can be delivered. The Windows workflow is explicitly intended to run from an administrative PowerShell session and uses `Invoke-Expression`. The Unix workflow passes the response directly to `sh`. Both patterns cross a network-to-code execution boundary without an independent integrity control. ### Attack Path 1. A user or automation operator creates or obtains a provisioning code. 2. Following the skill instructions, the operator runs the documented deployment command, potentially across many systems through an RMM platform. 3. The command retrieves the current response from `/dl/rmm`. 4. An attacker who has compromised the distribution endpoint or an equivalent trusted delivery component substitutes a malicious script. 5. PowerShell or `sh` interprets the substitute ...[truncated 970 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the mutable endpoint with a versioned, immutable artifact URL. 2. Publish a cryptographic SHA-256 or stronger digest through a separately protected release channel. 3. Download the installer to a newly created, access-restricted temporary file rather than piping it directly into an interpreter. 4. Verify the artifact digest before execution and abort on any mismatch. 5. On Windows, require a valid Authenticode signature from an explicitly trusted publisher. 6. On macOS, verify code signing and notarization where applicable. 7. Avoid `Invoke-Expression` and `curl | sh`; invoke a verified local artifact using a fixed interpreter and constrained arguments. 8. Display the artifact version, signer identity, and verification result before requesting explicit execution approval. 9. For RMM deployment, stage and approve the verified artifact internally rather than downloading mutable code independently on every endpoint. 10. Apply least privilege and avoid administrative execution unless the documented installation step demonstrably requires it. ]]>