T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/tools/fetch_oda.sh:7- Finding
Remote executable is downloaded and run without integrity verification
- Content
View full analysis
/dev/null; then chmod +x "$OUT" echo "Completed: $OUT" ``` ```bash # scripts/dxf2dwg.sh if [ ! -f "$ODA_IMG" ]; then echo "Retrieving ODA File Converter..." bash "$(dirname "$0")/tools/fetch_oda.sh" [ -f "$ODA_IMG" ] || { echo "Unable to retrieve converter"; exit 1; } fi echo "Extracting ODA File Converter..." chmod +x "$ODA_IMG" (cd /tmp && "$ODA_IMG" --appimage-extract >/dev/null 2>&1) ``` ### Technical Analysis The DWG conversion workflow automatically downloads an AppImage, assigns executable permission, and executes it. The script does not verify a cryptographic digest, detached signature, signing certificate, or trusted release manifest. Although HTTPS protects transport under normal conditions, it does not establish that the downloaded artifact is the exact binary reviewed by the project. The use of `curl -L` also follows redirects, making the effective source dependent on the complete remote delivery chain. This creates a mutable remote code-execution channel: compromise of the hosting service, redirect target, DNS/TLS trust chain, or upstream release process could replace the converter after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the download endpoint, an allowed redirect destination, or the upstream artifact distribution process. 2. The attacker serves a modified AppImage at the expected URL. 3. A user invokes `script ...[truncated 809 chars]- Remediation
View remediation