T08 · Insecure Dependencies
Warning
- Location
- SETUP.md:6
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SETUP.md:6` **Vulnerability Type**: Unpinned package installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```text - `requests` library (`pip install requests`) ``` ### Technical Analysis The setup instructions install `requests` without a fixed version, cryptographic hash, lockfile, or explicitly trusted package index. Consequently, the installed artifact can vary over time and depends on the package source configured in the user's environment. This does not establish that the legitimate `requests` package is malicious. The risk is that a compromised package release, compromised or misconfigured package index, or substituted package source could provide altered code. Python package installation and import can execute package-controlled code. In this Skill, such code would run in a process that may have access to `UNIFI_API_KEY`, `UNIFI_LOCAL_API_KEY`, and network-management access. ### Attack Path 1. An attacker compromises the configured Python package source, a relevant package release, or the user's package-index configuration. 2. The user follows `SETUP.md` and executes `pip install requests`. 3. Because the command specifies neither a reviewed version nor a required hash, the attacker-controlled artifact is accepted. 4. Malicious package code runs during installation or when `scripts/unifi.py` imports `requests`. 5. The code may read process environment variables and files available to the user, including UniFi credentials, and transmit them or perform actions with the user's privileges. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the user performing installation or running the Skill. The resulting scope may include: - Access to the Skill process's environment variables. - Theft of cloud or local UniFi API credentials. - Unauthorized access to UniFi infrastructure within the permi ...[truncated 447 chars]
- Remediation
- ## Remediation Suggestions 1. Add a dependency file containing an explicitly reviewed version, for example: ```text requests==<reviewed-version> ``` 2. Record cryptographic hashes and require their verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Generate and commit a lockfile using a suitable dependency-management tool. 4. Document the trusted package index and avoid inheriting untrusted `PIP_INDEX_URL` or `PIP_EXTRA_INDEX_URL` settings. 5. Install dependencies in an isolated virtual environment under a non-privileged account. 6. Periodically update the pinned version and hashes after security review rather than installing an unconstrained latest release.