T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:57- Finding
Mutable Remote Installer Is Executed Directly Through a Shell Pipeline
- Content
View full analysis
/dev/null || sudo mv bin/arduino-cli /usr/local/bin/ rm -rf bin/ ;; macos) if command -v brew >/dev/null 2>&1; then brew install arduino-cli else curl -fsSL https://raw.githubusercontent.com/arduino/arduino-cli/master/install.sh | sh sudo mv bin/arduino-cli /usr/local/bin/ rm -rf bin/ fi ;; ``` ### Technical Analysis The setup script retrieves the Arduino CLI installer from the mutable `master` branch and pipes the response directly into `sh`. The downloaded content is neither staged for review nor validated using a pinned digest or cryptographic signature. Although the URL is under Arduino's GitHub organization and is plausibly an official source, HTTPS only protects the transport connection. It does not ensure that the content of the mutable branch remains identical to the version reviewed during this audit. Compromise of the upstream repository, maintainer account, release process, or delivery infrastructure could change the effective payload without requiring any modification to this Skill. The shell executes the response with all permissions of the user running setup. The resulting executable may subsequently be copied to `/usr/local/bin` using `sudo`, increasing the security significance of a compromised download. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another part of the remote delivery chain. 2. The attacker modifies `install.sh` on the referenced `master` branch. 3. A user runs `scripts/s ...[truncated 982 chars]- Remediation
View remediation