T03 · Remote Payload Retrieval and Execution
Error
- Location
cli.py:330- Finding
Default Installer Executes an Unpinned Remote Script with System Privileges
- Content
View full analysis
/dev/null && apt-get install -y -qq nodejs 2>/dev/null", shell=True, capture_output=True, timeout=120, ) ``` ### Technical Analysis The normal installation path downloads mutable content from an external URL and immediately pipes it into `bash`. The downloaded script is not pinned to a particular release and is not verified using a checksum or cryptographic signature. The command then installs a system package through `apt-get`. Installers of this type are commonly run as root or through a privileged environment, so the remotely supplied script may inherit system-level privileges. The use of `shell=True` creates an explicit shell execution channel and further increases the consequences of a compromised response. Even though NodeSource is a recognizable software provider, the design delegates effective control of the executed payload to infrastructure that can change after this project has been audited. ### Attack Path 1. A user or AI Agent invokes `agent-reach install` without safe mode. 2. `_cmd_install()` calls `_install_system_deps()`. 3. The installer retrieves the current response from `https://deb.nodesource.com/setup_22.x`. 4. The response is passed directly to `bash` without integrity verification. 5. If the upstream account, hosting service, DNS/TLS trust path, or distribution endpoint is compromised, attacker-controlled shell commands execute. 6. If the installer is running with root privileges, those commands can modify the entire host. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the installer. In a privileged installation context, this may include: - Installation or replacement of system binaries - Reading o ...[truncated 316 chars]- Remediation
View remediation