T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Unreviewed Remote Installation Script Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start command downloads mutable content from `https://cli.inference.sh` and pipes it directly into `sh`. Users cannot inspect or independently authenticate the script before it executes. Although the document states that the installer detects the operating system and architecture, downloads a binary, and verifies its SHA-256 checksum, that verification is performed by the remote script itself. A compromised installer can replace both the downloaded artifact and expected checksum or omit verification entirely. HTTPS protects data in transit but does not mitigate compromise of the hosting service, DNS or certificate infrastructure, deployment pipeline, or publisher account. Installing the CLI may be necessary to use the documented posting integration, but executing an unpinned remote script is not the minimum access required. The same result can be achieved through a version-pinned download, independent integrity verification, and a separate installation step. ### Attack Path 1. An attacker compromises `cli.inference.sh`, its deployment pipeline, hosting account, or another component capable of controlling the returned response. 2. The attacker modifies the installation script to include arbitrary shell commands. 3. A user follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled response and sends it directly to `sh`. 5. The payload executes immediately with the permissions and environment of the invoking user. 6. The payload can access files and credentials available to that user, alter local configuration, retrieve further payloads, or establish persistence where user permissions permit. ### Impact Assessment Successful exploitation provides arbit ...[truncated 561 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Publish versioned CLI artifacts and pin the documentation to a specific reviewed release. 3. Provide separate download, verification, and installation commands so users can inspect each step. 4. Publish the expected SHA-256 digest through an independently trusted, immutable release channel. 5. Require users to compare the downloaded artifact's digest with the published value before execution. 6. Prefer a trusted package manager with signed metadata or cryptographically signed release artifacts. 7. Document the exact files, directories, network endpoints, and permissions used by the installer. 8. Keep installation separate from `infsh login` so successful installation does not immediately lead users into an authentication flow. 9. Avoid elevated installation privileges and place the binary in a user-controlled location when possible. A safer workflow should resemble: ```bash curl -fL -o infsh https://dist.inference.sh/releases/<pinned-version>/<platform>/infsh printf '%s %s\n' '<independently-published-sha256>' infsh | sha256sum -c - chmod 0755 infsh install -m 0755 infsh "$HOME/.local/bin/infsh" ``` The artifact URL, version, and digest must be real, release-specific values published through trusted release metadata rather than placeholders. ]]>