T03 · Remote Payload Retrieval and Execution
Error
- Location
- README.md:17
- Finding
- Mutable Remote PowerShell Installer Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `README.md:17-24` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```powershell # Step 1: Download the installation script locally $scriptPath = "$env:TEMP\install_dws.ps1" Invoke-WebRequest -Uri "https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1" -OutFile $scriptPath -UseBasicParsing # Step 2: Open and review it notepad $scriptPath # Step 3: Execute it after deciding that it is trusted & $scriptPath ``` ### Technical Analysis The installation instructions download a PowerShell script from the mutable `main` branch of an external GitHub repository and subsequently execute it. The downloaded installer is not pinned to an immutable commit, and the instructions do not perform cryptographic checksum or publisher-signature verification. Although the documentation tells users to inspect the script manually, this is advisory rather than an enforced security control. Users may execute the script without a meaningful review, and even a manual review does not provide reproducible verification for later downloads. Because the effective installer payload can change after this Skill package has been audited, the behavior constitutes remote payload retrieval and execution. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or the `main` branch. 2. The attacker modifies `scripts/install.ps1` to include malicious PowerShell commands. 3. A user follows the documented installation procedure. 4. `Invoke-WebRequest` downloads the attacker-controlled version into the user’s temporary directory. 5. The user executes the downloaded script with `& $scriptPath`. 6. The malicious commands run with the privileges of the WorkBuddy or PowerShell user. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user account. Depending on ...[truncated 592 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the mutable `main` URL with an immutable commit URL or a versioned release artifact. 2. Publish a SHA-256 digest for the exact installer and enforce verification before execution: ```powershell $expectedHash = "<reviewed-sha256>" $actualHash = (Get-FileHash -Algorithm SHA256 $scriptPath).Hash.ToLower() if ($actualHash -ne $expectedHash) { throw "Installer checksum verification failed" } ``` 3. Prefer shipping the reviewed installer inside the Skill package rather than retrieving executable code at installation time. 4. Digitally sign the PowerShell script and verify the Authenticode signature and expected publisher. 5. Ensure installation does not require administrator privileges unless a specific operation strictly requires them. 6. Document the exact pinned version and update it only through a new reviewed Skill release. ]]>