T03 · Remote Payload Retrieval and Execution
Error
- Location
- install.sh:8
- Finding
- Mutable Remote Installer Is Recommended for Direct Shell Execution<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:8-10`; `daemon.js:39-43` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Usage: # curl -sSL https://opensource.ludwitt.com/install | sh # # or after cloning the skill repo: # ./install.sh ``` ```js function checkUpdateAvailable(result) { if (updateCheckShown || !result?.apiVersion) return try { const auth = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf8')) const clientVersion = auth.clientVersion if (!clientVersion || clientVersion === result.apiVersion) return updateCheckShown = true console.error( `[ludwitt] A new API version is available (server: ${result.apiVersion}, yours: ${clientVersion}). Update: ${result.updateInstructions || 'curl -sSL https://opensource.ludwitt.com/install | sh'}` ) } catch {} } ``` ### Technical Analysis The installation instructions recommend downloading a mutable script from `https://opensource.ludwitt.com/install` and piping it directly into a shell. The downloaded content is neither pinned to a release nor verified using a cryptographic signature or checksum. Consequently, the code that ultimately executes can differ from the code reviewed in this package. The daemon also prints `result.updateInstructions`, which is supplied by the remote API. Although the daemon does not execute that field automatically, a compromised or malicious server can present arbitrary commands as trusted update instructions. The fallback instruction again uses the unsafe `curl | sh` pattern. This behavior is not necessary for the declared course-management functionality. The repository already supports installation from a locally cloned, reviewable script. ### Attack Path 1. An attacker compromises the Ludwitt web server, API deployment, DNS resolution, TLS termination, or release pipeline. 2. The attacker replaces the `/install` response with a malicious shell payload or retur ...[truncated 1200 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | sh` installation and update instructions. 2. Publish versioned release archives and pin installation to a specific version or commit. 3. Publish a SHA-256 or stronger digest through a separately authenticated release channel. 4. Cryptographically sign release artifacts and verify the signature before execution. 5. Download the installer to a local file, inspect and verify it, and only then execute it. 6. Do not accept executable update commands from the API. The API should return only a validated semantic version and a fixed HTTPS release URL. 7. Prefer package-manager or ClawHub updates with lockfiles, provenance metadata, and reproducible releases. 8. Ensure redirects are disabled or restricted to an explicit same-origin allowlist when retrieving release artifacts. ]]>