T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/setup-guide.md:359
- Finding
- Remote Installer Executed Directly with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `references/setup-guide.md:359` **Vulnerability Type**: Remote payload retrieval and privileged execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -s https://lidarr.audio/install.sh | sudo bash ``` ### Technical Analysis The setup guide pipes a mutable response from an external URL directly into a root-privileged Bash process. The installer is not pinned to a reviewed version and is not authenticated through a detached signature or a pinned cryptographic checksum. TLS protects the connection in transit under normal conditions, but it does not protect against compromise of the upstream website, its hosting environment, its certificate/DNS infrastructure, or a future unauthorized modification of the installer. The effective code executed by this instruction can therefore change after the Skill has been reviewed. Using `sudo bash` grants the downloaded payload unrestricted root access, exceeding the privileges required merely to download and inspect an installer. ### Attack Path 1. An attacker compromises the installer host, its release process, DNS resolution, or another relevant delivery component. 2. The attacker replaces or modifies `install.sh` with a malicious shell payload. 3. A user or agent follows the setup guide. 4. `curl` downloads the attacker-controlled response. 5. The response is immediately interpreted by `sudo bash`. 6. The payload executes as root without an integrity or review checkpoint. ### Impact Assessment Successful exploitation provides arbitrary root-level command execution. The payload could access all local files, steal media-service credentials, modify system configuration, install persistent services, alter firewall rules, tamper with applications, or fully compromise the host. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not pipe remote content directly into a shell. 2. Download a version-specific installer or package to a local file: ```bash curl --fail --show-error --location \ --output lidarr-installer.sh \ https://example.invalid/releases/VERSION/lidarr-installer.sh ``` 3. Publish and pin an expected SHA-256 checksum, then verify it before execution: ```bash echo "EXPECTED_SHA256 lidarr-installer.sh" | sha256sum --check - ``` 4. Prefer a detached signature verified against a pinned vendor signing key. 5. Present the downloaded script for review before execution. 6. Run the installer without root where possible; elevate only the individual operations that require administrative access. 7. Use `curl --fail --show-error --location` so HTTP errors are not silently interpreted as shell input. ]]>