T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup_resources.py:55- Finding
Unauthenticated Third-Party FFmpeg Executables Are Downloaded and Run
- Content
View full analysis
None: """Download URL to dest.""" log.info(f" Downloading: {url}") log.warn(f" Destination: {dest} (timeout {timeout}s)") old_timeout = socket.getdefaulttimeout() socket.setdefaulttimeout(timeout) try: urllib.request.urlretrieve(url, str(dest)) finally: socket.setdefaulttimeout(old_timeout) ``` ```python with zipfile.ZipFile(zip_path, "r") as zf: ffmpeg_zip_path = _find_in_zip(zf, "ffmpeg.exe") ffprobe_zip_path = _find_in_zip(zf, "ffprobe.exe") if not ffmpeg_zip_path or not ffprobe_zip_path: log.error("[ffmpeg] ffmpeg.exe or ffprobe.exe was not found") return False with zf.open(ffmpeg_zip_path) as src, open(ffmpeg_dest, "wb") as dst: shutil.copyfileobj(src, dst) with zf.open(ffprobe_zip_path) as src, open(ffprobe_dest, "wb") as dst: shutil.copyfileobj(src, dst) ``` ```python if _verify_exe(ffmpeg_dest, ("-version",)): log.info(f"[ffmpeg] Installation succeeded: {ffmpeg_dest}") ``` The verification function executes the downloaded file: ```python result = subprocess.run( [str(exe_path), flag], capture_output=True, timeout=15, ) ``` ### Technical Analysis The setup process downloads a ZIP archive containing Windows executables from a third-party GitHub release, extracts `ffmpeg.exe` and `ffprobe.exe`, and executes `ffmpeg.exe -version`. The archive and extracted binaries are not authenticated with a pinned SHA-256 digest, signed manifest, or trusted publisher signatur ...[truncated 1527 chars]- Remediation
View remediation