T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:132
- Finding
- Mutable Remote Installation Script Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:132` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/PayRam/payram-scripts/main/setup_payram.sh)" ``` ### Technical Analysis The documented self-hosting procedure downloads a shell script from the mutable `main` branch of an external GitHub repository and passes its contents directly to Bash. No immutable commit, signed release, cryptographic signature, or expected checksum is specified. The remote script is not included in the audited project, so its effective behavior cannot be reviewed from this package. Its contents can change after the Skill has passed review. The `curl -fsSL` options do not establish payload integrity. HTTPS protects the connection in transit but does not protect against: - Compromise of the upstream GitHub account or repository. - Malicious or accidental changes to the `main` branch. - Compromise of the upstream development process. - Repository ownership or access-control changes. Immediate execution also prevents the user from reviewing the downloaded content before it runs. This behavior is not necessary for the minimum declared functionality of connecting to the hosted MCP endpoint. A hosted connection only requires the separate `mcporter config add` operation. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the release workflow. 2. The attacker modifies `setup_payram.sh` on the `main` branch. 3. A user follows the self-hosted setup command from `SKILL.md`. 4. `curl` downloads the attacker-controlled version. 5. Bash immediately executes the payload with the privileges of the invoking user. 6. The payload can access local files, credentials, wallet material, containers, or network resources available to that user. ### Impact Assessment Successful exploitation provides arbitrary comm ...[truncated 620 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl`-to-Bash execution pattern. 2. Publish versioned, immutable releases and reference a specific release or commit. 3. Download the installer as a separate file without executing it: ```bash curl -fL -o setup_payram.sh https://example.invalid/path/to/versioned/setup_payram.sh ``` 4. Publish the expected SHA-256 checksum through an independently protected release channel and verify it before execution: ```bash echo "<EXPECTED_SHA256> setup_payram.sh" | sha256sum --check ``` 5. Cryptographically sign releases and require signature verification using a documented trusted signing key. 6. Instruct users to inspect the downloaded script before running it. 7. Vendor the reviewed installation script in the Skill package where practical. 8. Run installation with the least privileged dedicated account and avoid requesting root access unless a documented operation strictly requires it. 9. Separate optional self-hosting installation from the minimal hosted MCP connection workflow. ]]>