T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/bootstrap-env.sh:9
- Finding
- <![CDATA[Downloaded Wallet and TSS Executables Lack Independent Authenticity Verification]]><![CDATA[ ## Vulnerability Details **File Location**: `scripts/bootstrap-env.sh:9-12, 116, 151-178, 331-362` **Vulnerability Type**: Remote payload retrieval and insecure software supply chain **Risk Level**: High ### Vulnerable Code ```bash CAW_BASE_URL="${CAW_BASE_URL:-https://download.agenticwallet.cobo.com/binary-release}" CAW_VERSION="${CAW_VERSION:-v0.2.84}" TSS_BASE_URL="${TSS_BASE_URL:-https://download.tss.cobo.com/binary-release/latest}" ``` ```bash download_with_resume() { local url="$1" local dest="$2" mkdir -p "$(dirname "$dest")" curl --fail --location --silent --show-error --continue-at - --output "$dest" "$url" } ``` ```bash extract_tss_assets() { local tarball="$1" local tmp_dir tmp_dir="$(mktemp -d)" trap 'rm -rf "$tmp_dir"' RETURN tar -xzf "$tarball" -C "$tmp_dir" local tss_bin tss_bin="$(find "$tmp_dir" -type f -name "cobo-tss-node" | head -n 1)" if [[ -z "$tss_bin" ]]; then echo "cobo-tss-node binary not found in tarball" >&2 exit 1 fi mkdir -p "$CACHE_TSS_DIR" cp "$tss_bin" "$CACHE_TSS_DIR/cobo-tss-node" chmod 755 "$CACHE_TSS_DIR/cobo-tss-node" sha256_file "$CACHE_TSS_DIR/cobo-tss-node" > "$CACHE_TSS_DIR/cobo-tss-node.sha256" chmod 600 "$CACHE_TSS_DIR/cobo-tss-node.sha256" } ``` ```bash download_with_resume "$caw_url" "$caw_tmp_tar" echo "Verifying checksum..." download_with_resume "${caw_url}.sha256" "$caw_tmp_sum" local expected_sum actual_sum expected_sum="$(awk '{print $1}' "$caw_tmp_sum")" actual_sum="$(sha256_file "$caw_tmp_tar")" if [[ "$actual_sum" != "$expected_sum" ]]; then echo "Checksum mismatch: expected $expected_sum, got $actual_sum" >&2 exit 1 fi extract_caw_assets "$caw_tmp_tar" "$BIN_DIR" ``` ```bash download_with_resume "$tss_url" "$tss_tmp_tar" extract_tss_assets "$tss_tmp_tar" ``` ### Technical Analysis The bootstrap script retrieves native wallet and threshold-signature executables from remote URLs and installs them as executable files. CAW archives are checked ...[truncated 2001 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Publish a signed release manifest and verify it with a public key bundled through an independent, trusted channel. 2. Pin approved versions and cryptographic digests in reviewed Skill content or another independently protected source. 3. Add equivalent pre-extraction verification for the TSS archive. 4. Reject URL overrides that do not use HTTPS and restrict production downloads to an explicit hostname allowlist. 5. Treat custom mirrors as an advanced option requiring explicit user confirmation and a caller-provided trusted digest or signature. 6. Extract into a staging directory, validate archive paths and expected contents, and install atomically only after verification succeeds. 7. Refuse archives containing symbolic links, path traversal entries, unexpected executables, or extra files. 8. Preserve and audit the verified version, signer identity, and digest after installation. ]]>