T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/cli-setup.md:16
- Finding
- Remote Installer Piped Directly into Bash Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-setup.md:14-17` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```markdown **Curl installer (macOS/Linux):** ```bash curl -fsSL https://cli.brightdata.com/install.sh | bash ``` ``` ### Technical Analysis The installation instruction downloads a mutable script from an external server and pipes it directly into Bash. The downloaded content is neither displayed for review nor checked against a trusted cryptographic hash or signature before execution. HTTPS protects transport integrity and authenticates the server under the assumptions of the TLS trust model, but it does not guarantee that the hosted script remains benign. Compromise of the vendor website, CDN, DNS infrastructure, TLS credentials, deployment pipeline, or hosting account could cause different commands to be returned after the Skill has already passed review. Because Bash executes the response immediately, the effective payload is controlled by the remote endpoint at installation time. It inherits the privileges and accessible environment of the user running the command. ### Attack Path 1. An attacker compromises, replaces, or gains control over content served from `https://cli.brightdata.com/install.sh`. 2. A user or AI agent follows the documented installation instruction. 3. `curl` retrieves the attacker-controlled response. 4. The pipe sends that response directly to Bash without inspection or integrity verification. 5. Bash executes the payload with the invoking user's permissions. 6. The payload can access files, credentials, environment variables, network resources, and other assets available to that user. If the command is run with elevated privileges, the compromise can extend to the entire host. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. A malicious installer could: - ...[truncated 574 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Remove the direct `curl | bash` installation path. Prefer the documented package-manager installation after pinning an audited release. If a shell installer must remain available: 1. Download a version-specific artifact to a local file instead of piping it into a shell. 2. Publish its SHA-256 digest through a separately protected release channel. 3. Verify the digest or a cryptographic publisher signature before execution. 4. Allow the user to inspect the downloaded script. 5. Execute it as a separate command only after successful verification. 6. Avoid `sudo` and document the minimum permissions required. 7. Pin the installer URL to an immutable release rather than a mutable generic path. For example: ```bash curl -fL -o brightdata-install.sh \ https://cli.brightdata.com/releases/VERSION/install.sh printf '%s %s\n' 'EXPECTED_SHA256' 'brightdata-install.sh' | sha256sum -c - less brightdata-install.sh bash brightdata-install.sh ``` The expected digest must come from a trusted, independently authenticated source; a checksum downloaded from the same potentially compromised location does not provide sufficient protection. ]]>