T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:230
- Finding
- Unverified Remote Shell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 230 **Vulnerability Type**: Remote payload retrieval and arbitrary code execution **Risk Level**: Critical ### Vulnerable Code ```bash # Deploy PayRam stack on Ubuntu 22.04+ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/PayRam/payram-scripts/main/setup_payram.sh)" ``` ### Technical Analysis The installation instructions retrieve a shell script from an external GitHub repository and pass the response directly to Bash. The URL references the mutable `main` branch rather than an immutable commit or cryptographically verified release. No checksum, digital signature, release pin, or local review step is required before execution. Therefore, the payload executed by users can change after the Skill has been audited. A compromise of the upstream repository, maintainer account, or release workflow could turn this documented installation command into arbitrary command execution. This behavior is particularly sensitive because the script installs cryptocurrency payment infrastructure on a merchant-controlled VPS. The downloaded payload receives all privileges and environmental access held by the user executing the command. If run by `root` or through an administrator account, it can obtain system-wide control. Even under an unprivileged account, it may access that user's files, environment variables, wallet configuration, application credentials, and reachable services. Direct remote execution is not the minimum privilege or minimum-trust approach necessary for installation. A versioned artifact can instead be downloaded, authenticated, reviewed, and executed with narrowly documented permissions. ### Attack Path 1. An attacker compromises the `PayRam/payram-scripts` repository, a maintainer account, or the process that updates `setup_payram.sh`. 2. The attacker replaces or modifies `setup_payram.sh` on the mutable `main` branch. 3. A merchant or automated ...[truncated 1423 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | bash` equivalent and download the installer as a separate file. 2. Reference an immutable, reviewed release artifact or full commit hash rather than the mutable `main` branch. 3. Publish a SHA-256 checksum through a separately protected release channel and verify it before execution. 4. Cryptographically sign release artifacts and require signature verification against a documented maintainer key. 5. Allow users to inspect the downloaded script before running it. 6. Document every required permission, filesystem path, outbound connection, opened port, and service modification. 7. Run installation and services under dedicated, unprivileged accounts wherever possible. Require narrowly scoped privilege elevation only for specific administrative steps. 8. Avoid exposing wallet secrets or production credentials to the installer. Use a secret manager and separate installation from sensitive wallet provisioning. 9. Pin all components installed by the script to reviewed versions and provide a reproducible deployment manifest. 10. Add release provenance, dependency inventory, rollback instructions, and independent security review procedures. A safer installation pattern is: ```bash curl -fL -o setup_payram.sh \ "https://raw.githubusercontent.com/PayRam/payram-scripts/FULL_IMMUTABLE_COMMIT_HASH/setup_payram.sh" echo "EXPECTED_SHA256 setup_payram.sh" | sha256sum --check - less setup_payram.sh /bin/bash setup_payram.sh ``` The placeholder commit hash and checksum must be replaced with values tied to a reviewed release. Signature verification should be preferred over relying on a checksum obtained from the same distribution location.