T03 · Remote Payload Retrieval and Execution
- Location
references/provider-tgit.md:36- Finding
Unauthenticated Remote Binary Download and Execution
- Content
View full analysis
Vulnerability Details
File Location:
references/provider-tgit.md, lines 36–53
Vulnerability Type: Unauthenticated remote payload retrieval and execution
Risk Level: HighVulnerable Code
bash # pick the tarball for this machine's OS/arch (darwin|linux × x64|arm64) os=$(uname -s | tr '[:upper:]' '[:lower:]') # darwin | linux arch=$(uname -m); [ "$arch" = "x86_64" ] && arch=x64; [ "$arch" = "aarch64" ] && arch=arm64 dir="${TEAMAI_HOME:-$HOME/.teamai}/gf" # download + extract from the Tencent-internal mirror (same URL teamai uses) mkdir -p "$dir" curl -fsSL "http://mirrors.tencent.com/repository/generic/gongfeng-cli/files/channels/stable/gf-${os}-${arch}.tar.gz" | tar xz -C "$dir" # verify exactly as teamai does: the binary exists and is executable test -x "$dir/gf/bin/gf" && echo "gf installed OK" || echo "gf install FAILED"The extracted binary is subsequently executed:
bash "${TEAMAI_HOME:-$HOME/.teamai}/gf/gf/bin/gf" auth loginTechnical Analysis
When the Tencent TGit workflow is selected, the Skill requires the Agent to download a platform-specific archive over plaintext HTTP. The network response is streamed directly into
tarand extracted into the TeamAI directory.Plaintext HTTP provides neither transport confidentiality nor server authentication. A network-path attacker can therefore replace or modify the archive in transit. The post-download check only confirms that the expected path exists and is executable; it does not validate a cryptographic digest, publisher signature, or other proof of authenticity.
The workflow subsequently executes the extracted
gfbinary during authentication. As a result, attacker-controlled network content crosses the network-to-code trust boundary and runs under the current user’s account.Attack Path
- The user invokes the setup or join flow for a Tencent TGit repository.
- The Skill follows `references/pro ...[truncated 1119 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext HTTP endpoint with an authenticated HTTPS endpoint.
- Download the archive to a temporary file rather than piping it directly into
tar. - Verify a pinned cryptographic digest or trusted publisher signature before extraction.
- Abort installation if verification fails; checking only that a file exists and is executable is insufficient.
- Inspect archive member paths before extraction and reject absolute paths,
..traversal, symbolic-link escapes, and unexpected files. - Extract into a newly created private staging directory, validate the expected file layout, and atomically move verified files into the final directory.
- Execute the binary only after transport authentication, integrity verification, and safe extraction have all succeeded.