T03 · Remote Payload Retrieval and Execution
Warning
- Location
- scripts/install_train_env.sh:10
- Finding
- Mutable Remote Installer Execution and Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_train_env.sh:10-39` **Additional Location**: `SKILL.md:493-504` **Vulnerability Type**: Remote payload execution and insecure dependency management **Risk Level**: Medium ### Vulnerable Code ```bash # 0) Miniconda（如果没装） if [ ! -d ~/miniconda3 ]; then echo "--- 装 Miniconda ---" cd ~ if [ ! -f Miniconda3-latest-Linux-x86_64.sh ]; then wget -q https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh fi bash Miniconda3-latest-Linux-x86_64.sh -b -p ~/miniconda3 fi source ~/miniconda3/etc/profile.d/conda.sh # 1) Conda ToS（conda 26+ 必须） echo "--- accept conda ToS ---" conda tos accept --override-channels --channel https://repo.anaconda.com/pkgs/main 2>/dev/null || true conda tos accept --override-channels --channel https://repo.anaconda.com/pkgs/r 2>/dev/null || true # 2) 创建 rdk_env if ! conda env list | grep -q '^rdk_env '; then echo "--- 创建 rdk_env (python 3.10) ---" conda create -n rdk_env python=3.10 -y fi conda activate rdk_env # 3) 装包（清华源 + 长超时，国内必须） PIP_OPTS="-i https://pypi.tuna.tsinghua.edu.cn/simple --timeout 60 --retries 10" echo "--- 装 PyTorch (CUDA 12.1) ---" pip install $PIP_OPTS torch torchvision --index-url https://download.pytorch.org/whl/cu121 echo "--- 装 ultralytics + rdkx5-yolo-mapper + onnx ---" pip install $PIP_OPTS "ultralytics>=8.3.0" rdkx5-yolo-mapper onnx onnxsim echo "--- 修 rdkx5-yolo-mapper 缺的 setuptools ---" pip install $PIP_OPTS setuptools ``` ### Technical Analysis The script downloads a mutable file named `Miniconda3-latest-Linux-x86_64.sh` and immediately executes it without validating a cryptographic checksum or signature. Because the `latest` object can change after the Skill has been reviewed, the effective code executed by the Skill is not fixed by the audited package. The script also installs several third-party packages without exact versions or integrity hashes. The constraint `"ultralytics>=8.3.0"` ...[truncated 1890 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the mutable `latest` URL with a fixed Miniconda release URL. 2. Store the expected SHA-256 digest in the repository and verify it before execution: ```bash MINICONDA_FILE="Miniconda3-py310_XX.X.X-X-Linux-x86_64.sh" MINICONDA_SHA256="<vendor-published-sha256>" wget --https-only --secure-protocol=TLSv1_2 \ "https://repo.anaconda.com/miniconda/${MINICONDA_FILE}" printf '%s %s\n' "$MINICONDA_SHA256" "$MINICONDA_FILE" | sha256sum --check - bash "$MINICONDA_FILE" -b -p "$HOME/miniconda3" ``` 3. Abort installation if integrity verification fails. Do not use `|| true` around security-sensitive validation. 4. Pin every direct and transitive Python dependency to reviewed versions. 5. Generate a lock file containing hashes and install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 6. Use a single explicitly trusted package source where practical. Document any packages that must come from a separate vendor index. 7. Periodically regenerate and review the lock file rather than allowing automatic upgrades through `>=` constraints. 8. Run installation as an unprivileged dedicated account and avoid using the documented SSH workflow with `root`. 9. Apply the same fixed-version and hash-verification requirements to the duplicate commands in `SKILL.md`. ]]>