T03 · Remote Payload Retrieval and Execution
Unverified Existing Git Remote Can Supply Executed Code
scripts/update.sh:212Vulnerability Details
File Location: scripts/update.sh, lines 212-224
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: High
Vulnerable Code
# Add upstream if needed
git remote add upstream https://github.com/openclaw/openclaw.git 2>/dev/null || true
# Fetch upstream
run_cmd git fetch upstream
# Checkout and merge
run_cmd git checkout "$BRANCH"
run_cmd git merge "upstream/$BRANCH"
# Build and install
run_cmd npm run build
run_cmd npm i -g .
Technical Analysis
The script attempts to add the expected OpenClaw repository as the upstream remote, but it suppresses errors and unconditionally continues. If an upstream remote already exists, the command fails and || true accepts the failure without verifying the existing remote URL.
The script then fetches and merges code from that potentially attacker-controlled remote. It subsequently runs npm run build and npm i -g .. npm build and installation lifecycle scripts can execute arbitrary commands with the privileges of the user running the updater. The global installation also allows the fetched package to replace or modify the globally available OpenClaw command.
Attack Path
- An attacker, compromised local process, or malicious repository setup changes the target repository's
upstreamURL to an attacker-controlled Git repository. - The user invokes the update script and confirms the update.
git remote add upstream ...fails because the remote already exists.- The failure is silently ignored by
2>/dev/null || true. git fetch upstreamretrieves attacker-controlled commits.git merge "upstream/$BRANCH"incorporates the malicious payload.npm run buildornpm i -g .executes attacker-controlled npm lifecycle commands.- The malicious package can replace the globally installed OpenClaw executable or perform other actions under the invoking u ...[truncated 516 chars]
Remediation
Remediation Suggestions
- Retrieve the current URL using
git remote get-url upstreambefore fetching. - Require the URL to exactly match an approved canonical URL, accounting only for explicitly supported HTTPS or SSH forms.
- Abort with a clear security warning if the remote is missing or mismatched; do not silently ignore remote configuration errors.
- If changing an existing remote is supported, display the old and new URLs and require explicit user confirmation before running
git remote set-url. - Resolve the fetched branch to a commit and verify it against a trusted signed tag, signed commit, or administratively supplied commit hash before building it.
- Review or suppress npm lifecycle scripts where feasible, and avoid elevated execution during build or installation.
- Separate fetching, verification, building, and global installation into distinct confirmation stages.
A hardened remote check could follow this pattern:
expected_url="https://github.com/openclaw/openclaw.git"
if git remote get-url upstream >/dev/null 2>&1; then
actual_url="$(git remote get-url upstream)"
if [ "$actual_url" != "$expected_url" ]; then
log_error "Untrusted upstream remote: $actual_url"
exit 1
fi
else
run_cmd git remote add upstream "$expected_url"
fi