T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/outlook-setup.sh:25- Finding
Unpinned Remote Installer Is Recommended for Root-Level Execution
- Content
View full analysis
/dev/null; then echo -e "${RED}Error: Azure CLI not installed${NC}" echo "Install with: curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash" exit 1 fi ``` ### Technical Analysis When Azure CLI is unavailable, the setup script recommends downloading a shell script from a mutable, redirecting URL and piping it directly into `sudo bash`. The command provides no version pinning, signature verification, checksum verification, or opportunity to inspect the downloaded content before execution. Although the URL is operated by Microsoft, its effective payload can change after the Skill has been reviewed. Consequently, executing the recommended command transfers complete trust to the current response returned through the URL and its redirect chain. This behavior exceeds the privileges needed merely to report a missing prerequisite: the Skill itself does not need to cause arbitrary remotely supplied shell content to run as root. ### Attack Path 1. A user starts `outlook-setup.sh` on a system without Azure CLI. 2. The script displays the `curl | sudo bash` installation command. 3. The user follows the displayed instruction. 4. `curl` follows redirects and retrieves the current remote installer. 5. The response is passed directly to `sudo bash` without validation. 6. If the upstream installer, redirect destination, delivery infrastructure, or trust chain is compromised, attacker-controlled commands execute as root. ### Impact Assessment Successful exploitation provides unrestricted root-level code execution. An attacker could read or alter all local files, extract Outlook and Azure credentials, install persistent services, modify system tools, or compromise other users and applications on the host. ]]>- Remediation
View remediation