T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unverified Remote Installer Download and Immediate Shell Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external server and immediately execute the returned content through Bash or PowerShell. Neither command pins the installer to a reviewed version nor performs cryptographic signature or checksum verification before execution. HTTPS protects the connection in transit but does not establish that the retrieved script is the same artifact that was reviewed. Compromise of the hosting infrastructure, publishing account, DNS configuration, or installer build pipeline could cause arbitrary replacement content to execute. The pipeline also prevents a normal inspection step before execution. Installing the CLI may be necessary when it is unavailable, but direct remote-to-shell execution is not the minimum privilege or safest method required to perform that installation. ### Attack Path 1. A SafetyCulture operation fails because the `oo` CLI is not installed. 2. The Agent or user follows the documented first-time setup procedure. 3. `curl` or `Invoke-RestMethod` requests the current installer from `cli.oomol.com`. 4. A compromised hosting or delivery component returns attacker-controlled script content. 5. The pipe passes that content directly to Bash or `Invoke-Expression`. 6. The payload executes immediately without version validation, integrity verification, or prior inspection. 7. The payload can perform any action available to the invoking user and can attempt further privilege escalation if local conditions permit. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges ...[truncated 767 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation instructions. 2. Publish immutable, versioned installer artifacts through an official release channel. 3. Pin the documentation to a specific reviewed CLI version rather than a mutable installer endpoint. 4. Download the artifact to a local file without executing it: ```bash curl -fL -o oo-installer.sh "https://example.invalid/releases/<version>/install.sh" ``` 5. Publish a cryptographic checksum or signed release manifest through an independently protected channel. 6. Verify the checksum or digital signature before execution and terminate installation if validation fails. 7. Allow the installer to be inspected before execution, then require explicit user approval before running it. 8. Prefer a trusted package manager with signed packages and repository metadata where supported. 9. Run installation with ordinary user privileges unless a specific installation step demonstrably requires elevation. 10. Document the files, network destinations, and permissions used by the installer so users can assess its scope. ]]>