T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned and Unverified Third-Party Dependency Installation## Vulnerability Details **File Location**: `requirements.txt:1-2`, invoked by `setup.sh:7-8` **Vulnerability Type**: Supply-chain exposure through mutable dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-2`: ```text python-docx>=1.1.2 lxml>=5.3.0 ``` `setup.sh:7-8`: ```bash python -m pip install --upgrade pip python -m pip install -r requirements.txt ``` ### Technical Analysis The dependency declarations use lower-bound constraints rather than exact, reviewed versions. Consequently, later executions of `setup.sh` may install future releases that were not present during this audit. No lock file or cryptographic hashes are supplied to verify the integrity of downloaded distributions. The setup script also upgrades pip to the latest version available from the configured package index. This introduces another mutable component into the installation process. The packages are obtained from whatever index pip is configured to trust, rather than from an explicitly documented and trusted repository. This does not establish that the currently named packages are malicious. It creates a supply-chain exposure in which a compromised package release, package index, mirror, or local pip configuration could cause unreviewed code to be installed and potentially executed. ### Attack Path 1. A user follows the installation instructions and executes `setup.sh`. 2. The script activates a virtual environment and upgrades pip using the configured package index. 3. pip resolves `python-docx` and `lxml` to any available versions satisfying the open-ended `>=` constraints. 4. An attacker compromises a qualifying future release, the configured package index or mirror, or the dependency delivery path. 5. pip downloads and installs the attacker-controlled distribution. 6. Malicious build or installation logic may execute with the privileges of the user running `setup.sh`. 7. Installed malicious runtime code may execute again when `ods.py` imports `docx ...[truncated 709 chars]
- Remediation
- ## Remediation Suggestions 1. Replace lower-bound constraints with exact versions that have been reviewed and tested: ```text python-docx==1.1.2 lxml==5.3.0 ``` 2. Generate a hash-locked dependency file and require hash verification during installation. For example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Include hashes for every permitted wheel or source distribution, including transitive dependencies. 4. Remove the unconditional pip upgrade from `setup.sh`, or pin pip to a reviewed version with integrity verification. 5. Explicitly document and enforce the trusted package index rather than relying silently on user-level or system-level pip configuration. 6. Perform dependency updates through a controlled review process that includes vulnerability scanning, provenance checks, testing, and lock-file regeneration. 7. Run installation and document processing as an unprivileged account with access only to the files required for the task.