T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/outlook-setup.sh:25
- Finding
- Unpinned Remote Installer Is Recommended for Root-Level Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/outlook-setup.sh:25-29` **Vulnerability Type**: Unverified remote payload retrieval and privileged execution **Risk Level**: Critical ### Vulnerable Code ```bash if ! command -v az &> /dev/null; then echo -e "${RED}Error: Azure CLI not installed${NC}" echo "Install with: curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash" exit 1 fi ``` ### Technical Analysis When Azure CLI is unavailable, the setup script recommends downloading a shell script from a mutable, redirecting URL and piping it directly into `sudo bash`. The command provides no version pinning, signature verification, checksum verification, or opportunity to inspect the downloaded content before execution. Although the URL is operated by Microsoft, its effective payload can change after the Skill has been reviewed. Consequently, executing the recommended command transfers complete trust to the current response returned through the URL and its redirect chain. This behavior exceeds the privileges needed merely to report a missing prerequisite: the Skill itself does not need to cause arbitrary remotely supplied shell content to run as root. ### Attack Path 1. A user starts `outlook-setup.sh` on a system without Azure CLI. 2. The script displays the `curl | sudo bash` installation command. 3. The user follows the displayed instruction. 4. `curl` follows redirects and retrieves the current remote installer. 5. The response is passed directly to `sudo bash` without validation. 6. If the upstream installer, redirect destination, delivery infrastructure, or trust chain is compromised, attacker-controlled commands execute as root. ### Impact Assessment Successful exploitation provides unrestricted root-level code execution. An attacker could read or alter all local files, extract Outlook and Azure credentials, install persistent services, modify system tools, or compromise other users and applications on the host. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the `curl | sudo bash` recommendation. - Direct users to official Azure CLI installation documentation or use the operating system's authenticated package manager. - If automated retrieval is necessary, pin an explicit installer version and download it to a file before execution. - Verify a vendor signature or a securely distributed, pinned cryptographic checksum. - Display the resolved source and require explicit user review before privileged execution. - Avoid requesting root privileges except for the specific package-management operation that requires them. ]]>