T03 · Remote Payload Retrieval and Execution
Error
- Location
- install/references/linux-yum.md:28
- Finding
- Unverified Remote Installation Script Executed with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `install/references/linux-yum.md:28-34` **Vulnerability Type**: Unverified remote payload execution as root **Risk Level**: Critical ### Vulnerable Code ```bash > **Security note:** The following command downloads and executes a remote script with root privileges. Review the script content before running, or prefer the yum repo method above. curl -fsSL https://obbusiness-private.oss-cn-shanghai.aliyuncs.com/download-center/opensource/seekdb/seekdb_install.sh -o /tmp/seekdb_install.sh # Review the script before executing: less /tmp/seekdb_install.sh sudo bash /tmp/seekdb_install.sh ``` ### Technical Analysis The installation flow retrieves a mutable shell script from an external object-storage hostname and subsequently executes it through `sudo bash`. No cryptographic digest, detached signature, package signature, or expected signer identity is verified before execution. Opening the file with `less` does not provide a security boundary. It neither guarantees that the user performs a meaningful review nor detects a sophisticated malicious modification. The downloaded file also resides at a predictable path under `/tmp`, which is not as robust as creating a private temporary file using `mktemp`. Although installing a system database can legitimately require administrative privileges, granting root privileges to an unauthenticated remote script exceeds the minimum safe trust model for that task. ### Attack Path 1. An attacker compromises the object-storage account, the published script, or another part of the delivery infrastructure. 2. Alternatively, an attacker who can interfere with the trusted network or TLS environment redirects the request or alters the returned payload. 3. The Skill downloads the attacker-controlled script to `/tmp/seekdb_install.sh`. 4. The user or agent displays the script with `less`, but no automated integrity or signature validation occurs. 5. The Skill executes the payload ...[truncated 550 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the remote-script alternative and use a signed RPM repository as the default and preferred installation mechanism. 2. If the script must remain available: - Host it under an official, clearly controlled release domain. - Pin an immutable release version rather than a mutable path. - Publish its SHA-256 digest through an independently authenticated channel. - Verify the digest before execution and abort on any mismatch. - Prefer a detached signature and verify it against a pinned vendor signing key. 3. Create the temporary file with `mktemp`, set restrictive permissions, and delete it after use. 4. Do not automatically proceed from review to root execution. Obtain explicit confirmation after displaying the verified script and explain that it will execute with root privileges. 5. Where possible, replace the script with signed packages whose installation scripts are covered by RPM signature verification. ]]>