T08 · Insecure Dependencies
Error
- Location
- scripts/selfheal_runner.sh:91
- Finding
- Bypassable Git Remote Allowlist Permits Building Attacker-Controlled Source## Vulnerability Details **File Location**: `scripts/selfheal_runner.sh`, lines 91-96 **Vulnerability Type**: Supply-chain source validation bypass **Risk Level**: High ### Vulnerable Code ```sh selfheal_source_trusted() { # rc 0: provenance ok; rc 4: unknown/untrusted origin [ -d "$SELFHEAL_LLAMA_DIR/.git" ] || { selfheal_log "llama.cpp is not a git checkout — provenance unknown"; return 4; } _remote=$(git -C "$SELFHEAL_LLAMA_DIR" config --get remote.origin.url 2>/dev/null || echo "") case "$_remote" in *github.com/ggml-org/llama.cpp*|*github.com/ggerganov/llama.cpp*) return 0 ;; *) selfheal_log "untrusted llama.cpp remote '$_remote' (expecting github.com/ggml-org/llama.cpp)"; return 4 ;; esac } ``` ### Technical Analysis The trusted-source check performs substring matching against the complete Git remote URL. It does not parse and validate the remote hostname and repository path separately. Consequently, an attacker-controlled URL containing an allowed string can pass validation. Examples include: ```text https://evil.example/github.com/ggml-org/llama.cpp ssh://evil.example/path/github.com/ggml-org/llama.cpp ``` After this check succeeds, `selfheal_rebuild_llama` runs CMake against the local checkout. CMake configuration and build files are executable build logic and may invoke arbitrary commands. Therefore, accepting a malicious checkout as trusted can result in local code execution. The explicit `SELFHEAL_MODE=fix` requirement reduces accidental exploitation but does not make the provenance check effective once a user has consented to repair operations. ### Attack Path 1. An attacker places or causes the user to obtain a malicious Git checkout at `$SELFHEAL_LLAMA_DIR`. 2. The attacker sets its `remote.origin.url` to an attacker-controlled URL containing the substring `github.com/ggml-org/llama.cpp`. 3. The expected llama.cpp binary is absent or fails its version probe. 4. The ...[truncated 914 chars]
- Remediation
- ## Remediation Suggestions Replace substring matching with canonical, exact remote validation: 1. Parse supported Git URL forms, including HTTPS, `ssh://`, and SCP-style SSH URLs. 2. Require the normalized hostname to be exactly `github.com`. 3. Require the normalized repository path to be exactly `ggml-org/llama.cpp` or the explicitly supported legacy repository. 4. Reject URLs containing user-info tricks, unexpected ports, additional path components, encoded separators, or unrecognized schemes. 5. Add regression tests for deceptive URLs such as `evil.example/github.com/ggml-org/llama.cpp` and `github.com.attacker.example/ggml-org/llama.cpp`. 6. For stronger supply-chain protection, require a known commit hash or verified signed tag rather than trusting the remote name alone. 7. Consider cloning the trusted repository into a newly created directory instead of building a preexisting checkout whose worktree may have uncommitted malicious modifications.