T03 · Remote Payload Retrieval and Execution
Error
- Location
references/application-deployment.md:38- Finding
Unverified Remote Script Executed with Root Privileges
- Content
View full analysis
\ --InstanceIds '["lhins-xxx"]' \ --Content "curl -fsSL https://rpm.nodesource.com/setup_18.x | sudo bash - && sudo yum install -y nodejs" ``` ### Technical Analysis The deployment workflow downloads a mutable shell script from an external URL and pipes it directly into a root shell. The payload is not pinned to a specific immutable version, inspected, hash-verified, or authenticated with a vendor signing key before execution. Although installing Node.js is consistent with application deployment, executing remotely retrieved content directly as root exceeds the minimum privilege necessary. The external script can change after the Skill has been reviewed, making the effective privileged payload unauditable. ### Attack Path 1. An attacker compromises the external script host, its publishing process, or another component of the delivery chain. 2. The user asks the Agent to prepare a Node.js deployment. 3. The Agent follows the documented TAT command. 4. The target instance downloads the attacker-controlled script. 5. `sudo bash` executes the script with root privileges. 6. The attacker can install malware, steal application secrets, alter services, create accounts, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary root-level code execution on each targeted Lighthouse instance. The attacker can access all local files and credentials available to root, modify the operating system, compromise deployed applications, pivot through accessible networks, and install persistent services. ]]>- Remediation
View remediation