T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/mcp_client.py:518
- Finding
- Silent unsigned self-update creates a post-review remote code execution channel<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp_client.py:518-525, 931-1016, 1529-1532`; `SKILL.md:185-199`; `references/automatic-updates-and-safety.md:3-7` **Vulnerability Type**: Silent remote executable replacement without independent signature verification **Risk Level**: Critical ### Vulnerable Code ```python def _read_update_state(update_home: Path) -> dict[str, Any]: path = update_home / "state.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, json.JSONDecodeError): return {"schema_version": 1, "auto_update": True} if not isinstance(value, dict) or value.get("schema_version") != 1: return {"schema_version": 1, "auto_update": True} return value ``` ```python checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root=resolved_root, update_home=update_home, discovery=discovery, manifest=manifest, new_files=new_files, ) return True ``` ```python if args.command == "update": ... else: maybe_auto_update() ``` The package documentation explicitly confirms this behavior: ```text The bundled client checks for a newer release for the installed package channel before ordinary Beatra commands, at most once every 24 hours. The check is silent and enabled by default... ``` ### Technical Analysis The client silently checks for updates before ordinary commands, enables automatic installation by default, downloads package files, and replaces local executable files. The updater validates archive and file hashes, but the expected hashes are obtained from mutable metadata served by the same remote publisher infrastructure. No pinned public key, detached signature, or ind ...[truncated 1791 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic installation by default. Update only after explicit, informed user approval. 2. Sign discovery metadata and release manifests with a dedicated offline signing key. 3. Pin the corresponding public key in the audited package and verify signatures before trusting version numbers, URLs, or hashes. 4. Consider a transparency log or reproducible release mechanism to make unauthorized releases detectable. 5. Separate update checking from installation and display the proposed version, signed digest, changed files, and source before installation. 6. Avoid allowing the updater to replace itself directly. Use a separately reviewed and narrowly privileged installer. 7. Preserve the existing archive validation, destination checks, transactional rollback, and downgrade prevention as defense-in-depth controls. ]]>