T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned Third-Party Dependency Installed into the User Environment
- Content
View full analysis
=2.31.0 ``` `scripts/setup_env.sh:1-4`: ```bash #!/usr/bin/env bash set -euo pipefail python3 -m pip install --user -r "$(dirname "$0")/requirements.txt" echo "[ok] Dependencies installed" ``` ### Technical Analysis The requirement uses an open-ended version constraint rather than an exact, audited version and does not provide package integrity hashes. Consequently, every fresh installation can resolve to a different future release of `requests` and its transitive dependencies. The setup script also uses `pip install --user`, which modifies the user's persistent Python package environment instead of creating an isolated virtual environment. This can introduce dependency conflicts and makes the installed code available to other Python programs executed by the same user. This is a supply-chain hardening weakness rather than evidence that the currently named package is malicious. Exploitation would require compromise of an allowed package release, its distribution channel, or one of its dependencies. ### Attack Path 1. An attacker compromises an allowed future release of `requests`, one of its transitive dependencies, or the relevant package-distribution channel. 2. The malicious release still satisfies the constraint `requests>=2.31.0`. 3. A user runs `bash scripts/setup_env.sh`. 4. `pip` resolves and downloads the compromised version without checking a repository-provided hash. 5. Package installation or subsequent import executes attacker-controlled code with the privileges of the user running the setup or generation script. ### Impact Assessment Successful exploitation could execute arbitrary code with the current user's privileges. This could expose files, environment va ...[truncated 226 chars]- Remediation
View remediation
--hash=sha256: ``` Then install from an isolated environment using hash enforcement: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r scripts/requirements.txt ``` ]]>