T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:52- Finding
Mutable Remote Source Is Retrieved and Processed Without Integrity Verification
- Content
View full analysis
/dev/null 2>&1) fi ``` The retrieved files are subsequently copied into generated projects by `scripts/render.py:977-1003` and processed again during compilation: ```python _candidates = [ os.environ.get('THUTHESIS_DIR', ''), '/tmp/thuthesis-latest', str(Path(__file__).parent.parent / 'thuthesis'), ] for f in cls_files: src = src_base / f if src.exists(): shutil.copy2(src, output_dir / f) ``` ### Technical Analysis The setup process retrieves the current state of a mutable Git branch using either `git pull` or a shallow `git clone`. It does not pin an audited commit, verify a release signature, compare a cryptographic digest, or validate the downloaded file set. The downloaded `thuthesis.ins` file is then directly processed by XeLaTeX. Generated class, bibliography, and style files are copied into user projects and loaded during later XeLaTeX or BibTeX executions. This creates a remote payload execution channel whose effective contents may change after the Skill package itself has been reviewed. HTTPS protects transport integrity but does not protect against compromise of the upstream repository, maintainer account, release workflow, or an unexpected upstream change. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its delivery workflow. 2. The attacker modifies `thuthesis.ins`, a cla ...[truncated 1255 chars]- Remediation
View remediation