T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/ecosystem.md:112
- Finding
- Unverified Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `references/ecosystem.md`, lines 112 and 423 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable code at line 112:** ```markdown | **LUKSO CLI** | `curl https://install.lukso.network | sh` — node/validator setup | ``` **Vulnerable code at line 423:** ```markdown 2. **Medium (LUKSO CLI):** `curl https://install.lukso.network | sh` → `lukso init` → `lukso install` → `lukso start --validator` ``` ### Technical Analysis These instructions download a mutable script from an external URL and pass it directly to `sh`. The payload executes before the user can inspect it, and the instructions provide no immutable version pin, cryptographic checksum, signature verification, or independent authenticity check. Although `install.lukso.network` appears related to the documented ecosystem, its current response is not part of the audited Skill package. The effective code can therefore change after review. Compromise of the hosting service, DNS, deployment pipeline, TLS termination, or installer source could convert a legitimate installation command into arbitrary command execution. This behavior exceeds the minimum privileges needed by a documentation and knowledge-reference Skill. Explaining validator installation does not require recommending immediate execution of unverified remote shell content. ### Attack Path 1. A user asks the Skill for LUKSO node or validator setup instructions. 2. The Agent reproduces the documented `curl ... | sh` command. 3. The user executes the command in a local shell. 4. `curl` retrieves the current, mutable response from the remote installer host. 5. `sh` executes that response immediately without inspection or integrity verification. 6. If the remote delivery path has been compromised, attacker-controlled commands run with the privileges of the invoking user. 7. The payload may then target node config ...[truncated 932 chars]
- Remediation
- ## Remediation Suggestions Replace both direct pipelines with a staged and verifiable installation procedure: 1. Pin the installer to an immutable release URL or commit rather than a mutable endpoint. 2. Download the script to a local file without executing it. 3. Publish a SHA-256 checksum and preferably a cryptographic release signature through an independent trusted channel. 4. Verify the checksum or signature before execution. 5. Review the downloaded script and document the files, services, ports, and permissions it changes. 6. Run it under a dedicated unprivileged account or in an isolated environment. 7. Do not recommend `sudo` unless a specific operation demonstrably requires it. 8. Provide package-manager or reproducible container-based installation alternatives where available. Example hardened flow: ```sh curl -fL --proto '=https' --tlsv1.2 \ -o lukso-installer.sh \ https://example.invalid/lukso/releases/IMMUTABLE_VERSION/install.sh printf '%s %s\n' 'EXPECTED_SHA256' 'lukso-installer.sh' | sha256sum -c - less lukso-installer.sh sh lukso-installer.sh ``` The documentation must replace the placeholder URL and checksum with an official immutable release artifact and independently published expected digest.