T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:56- Finding
Unverified Remote Installation Scripts Are Executed Directly
- Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis Both installation commands retrieve a mutable script from an external server and pass it directly to a command interpreter. The downloaded content is not pinned to a reviewed version and is not validated using a cryptographic checksum or digital signature. HTTPS authenticates the server and protects data in transit under normal conditions, but it does not establish that the current script is identical to the version reviewed during this audit. The effective code can change after publication. A compromised hosting server, deployment pipeline, DNS configuration, TLS credentials, or vendor account could therefore cause arbitrary attacker-controlled code to be executed. The pipeline also prevents meaningful review before execution. The Bash command is especially problematic because a partial response can begin executing before the complete download succeeds. The PowerShell `Invoke-Expression` pattern has the same fundamental trust issue. ### Attack Path 1. The `oo` command is absent, causing the user or agent to follow the documented setup procedure. 2. The installation endpoint or its publishing infrastructure is compromised, or the remotely hosted script is otherwise replaced. 3. The user runs the documented `curl | bash` or `irm | iex` command. 4. The shell immediately interprets the attacker-controlled response. 5. The payload executes with the privileges of the account running the installation com ...[truncated 784 chars]- Remediation
View remediation
oo-install.sh" | sha256sum --check - less oo-install.sh bash oo-install.sh ``` The checksum must be obtained from a trusted, independently protected source rather than from the same mutable endpoint as the artifact. ]]>