T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:17
- Finding
- Unpinned Remote Installer Is Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Remote mutable code retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command downloads content from `https://cli.inference.sh` and immediately pipes it into `sh`. The downloaded script is neither saved for inspection nor verified against a version-pinned digest or trusted cryptographic signature before execution. The documentation states that the installer verifies the SHA-256 checksum of the CLI binary. However, this does not establish trust in the installer itself: the remote script is already executing with the user's privileges when it performs that verification. Both the verification logic and expected checksum can therefore be changed together if the installer endpoint is compromised. This remote installation method is not necessary for the declared text-to-speech functionality. A versioned CLI binary can instead be downloaded and independently verified before execution. ### Attack Path 1. An attacker compromises the installer hosting account, the distribution infrastructure, DNS resolution, or another component capable of changing the response from `cli.inference.sh`. 2. The attacker replaces the expected installer with a malicious shell script. 3. A user or agent follows the documented Quick Start command. 4. `curl` retrieves the modified response and pipes it directly into `sh`. 5. The malicious script executes arbitrary commands with all privileges available to the invoking account. 6. The script can steal credentials, alter local files, install persistence, or replace the legitimate `infsh` binary before continuing with an apparently normal login flow. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. This permits access to files, environment variables, SSH key ...[truncated 525 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation flow. 2. Publish versioned CLI artifacts and require users to select an explicit version. 3. Download the artifact to a local file before executing or installing it. 4. Verify the artifact using a SHA-256 digest or cryptographic signature obtained through an independent, trusted, version-pinned channel. 5. Abort installation if verification fails; do not download the expected digest from the same mutable source as the artifact without signature validation. 6. Prefer installation through a reputable package manager with package signing and immutable version selection. 7. Run the CLI as an unprivileged user and document the minimum filesystem and network permissions it requires. 8. Provide manual inspection and verification commands as the primary installation method rather than as an optional alternative. A safer conceptual flow is: ```bash curl -fSLo infsh "<versioned-artifact-url>" printf '%s %s\n' "<trusted-pinned-sha256>" "infsh" | sha256sum -c - chmod 0755 infsh ./infsh login ``` The digest in this example must be supplied through a trusted, immutable release record rather than copied dynamically from the same mutable installer. ]]>