T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/module_manager.py:486
- Finding
- Mutable Remote Module Code Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/module_manager.py:486-566` **Vulnerability Type**: Remote payload retrieval and supply-chain code execution **Risk Level**: High ### Vulnerable Code ```python clone_url = f"https://github.com/{github_repo}.git" result = subprocess.run( ["git", "clone", "--depth", "1", clone_url, install_path], capture_output=True, text=True, timeout=120 ) # Run init_db.py if it exists init_db_path = os.path.join(install_path, "init_db.py") tables_created = 0 if os.path.isfile(init_db_path): try: result = subprocess.run( [sys.executable, init_db_path], capture_output=True, text=True, timeout=60 ) if result.returncode != 0: _mark_failed(conn, module_name, f"init_db.py failed: {result.stderr.strip()}") err(f"init_db.py failed for {module_name}: {result.stderr.strip()}") ``` ### Technical Analysis The module installer clones the current head of a configured GitHub repository using a shallow clone and then executes a downloaded `init_db.py` file with the current Python interpreter. It does not pin the repository to an audited commit, verify a cryptographic digest, verify a signed tag, or inspect the downloaded code before execution. The module name must exist in the bundled registry, and the reviewed registry points to `avansaber/*` repositories. This reduces arbitrary-URL abuse but does not mitigate compromise of an allowed repository, maintainer account, GitHub organization, or upstream branch. The effective executable payload can change after this Skill package has been reviewed. The execution is necessary for the declared module-installation feature, but mutable branch-head execution grants more trust than the minimum privileges required. ### Attack Path 1. An attacker compromises an allowed repository or an authorized maintainer account. 2. The attacker modifies the repository's default branch and adds malicious behavior to ...[truncated 1057 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every module to an immutable reviewed commit hash rather than the default branch. 2. Store the expected commit and a SHA-256 manifest in `module_registry.json`. 3. Verify the resolved commit and all security-sensitive files before execution. 4. Prefer signed release tags and verify signatures against bundled trusted maintainer keys. 5. Present the exact repository, commit, signer, and changed-file summary to the user before execution. 6. Execute module initialization in a restricted subprocess with: - A minimal environment. - No unnecessary network access. - A dedicated temporary database or narrowly scoped database capability. - Filesystem access limited to the module directory and required ERP paths. 7. Do not automatically execute `init_db.py`; define a declarative migration format or require a separately confirmed initialization step. 8. Retain the verified commit hash in the installation audit record and refuse updates that fail signature or digest verification. ]]>