T03 · Remote Payload Retrieval and Execution
Error
- Location
cli/scripts/download_release_binary.sh:68- Finding
Remote Binary Is Downloaded and Executed Without Cryptographic Authenticity Verification
- Content
View full analysis
/dev/null 2>&1 else "${bin_path}" --help >/dev/null 2>&1 fi } ``` ```bash case "$(uname -s)" in Darwin|Linux) zip_name="${file}.zip" zip_url="${BASE_URL}/${zip_name}" tmp_zip="${RELEASE_DIR}/${zip_name}.tmp.$$" tmp_extract_dir="$(mktemp -d "${TMPDIR:-/tmp}/fangcloud-extract.XXXXXX")" trap 'rm -f "${tmp_zip}"; rm -rf "${tmp_extract_dir}"' EXIT echo "Downloading ${zip_url}" curl -fL "${zip_url}" -o "${tmp_zip}" extracted_bin="$(extract_binary_from_zip "${tmp_zip}" "${file}" "${tmp_extract_dir}")" if [ -z "${extracted_bin}" ] || [ ! -f "${extracted_bin}" ]; then echo "Downloaded zip does not contain expected binary: ${file}" >&2 exit 1 fi chmod +x "${extracted_bin}" if ! validate_binary "${extracted_bin}"; then echo "Downloaded binary is invalid and cannot run: ${zip_url}" >&2 echo "Please update the release artifact at the source URL." >&2 exit 1 fi mv -f "${tmp_zip}" "${RELEASE_DIR}/${zip_name}" cp "${extracted_bin}" "${bin_target}" chmod +x "${bin_target}" ``` The runner subsequently downloads and executes the binary: ```bash is_healthy() { local bin_path="$1" if [ "${os}" = "Darwin" ]; then codesign --verify --verbose=2 "${bin_path}" >/dev/null 2>&1 else "${bin_path}" --help >/dev/null 2>&1 fi } if [ ! -x "${target}" ] | ...[truncated 2981 chars]- Remediation
View remediation