T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/update.sh:100- Finding
Unverified Remote Update Script Is Downloaded and Executed
- Content
View full analysis
/dev/null; then if curl -s -f --connect-timeout 10 "$url" -o "$tmp_file" 2>/dev/null; then echo "$tmp_file" return 0 fi elif command -v wget &> /dev/null; then if wget -q --timeout=10 "$url" -O "$tmp_file" 2>/dev/null; then echo "$tmp_file" return 0 fi fi rm -f "$tmp_file" return 1 } ``` ```bash if version_gt "$REMOTE_VERSION" "$LOCAL_VERSION"; then echo -e "${GREEN}New version available!${NC}" echo "" # Get update URL from manifest UPDATE_SCRIPT_URL=$(grep -o '"updateUrl"[[:space:]]*:[[:space:]]*"[^"]*"' "$MANIFEST_FILE" | head -1 | cut -d'"' -f4) if [ -n "$UPDATE_SCRIPT_URL" ]; then echo "Fetching update script..." UPDATE_SCRIPT=$(mktemp) if curl -s -f "$UPDATE_SCRIPT_URL" -o "$UPDATE_SCRIPT" 2>/dev/null || \ wget -q "$UPDATE_SCRIPT_URL" -O "$UPDATE_SCRIPT" 2>/dev/null; then echo "Running update..." echo "" # CRITICAL: Never modify .env export PROTECT_ENV=1 export BASE_DIR="$BASE_DIR" bash "$UPDATE_SCRIPT" rm -f "$UPDATE_SCRIPT" echo -e "${GREEN}✅ Update complete!${NC}" else echo -e "${RED}❌ Failed to fetch update script${NC}" rm -f "$UPDATE_SCRIPT" fi else echo -e "${YELLOW}⚠ No updateUrl i ...[truncated 2786 chars]- Remediation
View remediation