T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Remote Installer Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ``` ### Technical Analysis This command downloads a mutable shell script from an external endpoint and passes it directly to `sh`. The TLS restrictions protect the network connection, but they do not independently verify the integrity or expected contents of the downloaded script. No version, cryptographic digest, or digital signature is pinned before execution. Installing Rust is consistent with the Skill's declared setup functionality. However, immediate remote script execution is not the minimum-risk method of performing that installation. The effective code can change after the Skill has been reviewed, and it executes with all permissions held by the user invoking the command. ### Attack Path 1. An attacker compromises or gains influence over the installer endpoint, its hosting infrastructure, DNS resolution, or a trusted certificate path. 2. The endpoint returns an attacker-controlled shell script. 3. `curl` retrieves the script without validating it against an expected digest or signature. 4. The shell pipe immediately passes the response to `sh`. 5. The malicious script executes locally with the invoking user's permissions. ### Impact Assessment Successful exploitation permits arbitrary command execution as the user following the instructions. The resulting access may include reading or modifying that user's files, source code, shell configuration, development credentials, and accessible signing keys. If the command is unnecessarily run with elevated privileges, the impact could expand to system-wide compromise. No privilege escalation, persistence, or credential exfiltration is directly present in the audited file itself.
- Remediation
- ## Remediation Suggestions - Do not pipe content obtained from the network directly into a shell. - Prefer an operating-system package manager or an already installed Rust toolchain where practical. - If the official installer must be used, download it to a local file first. - Verify the downloaded artifact using an official digital signature or a pinned SHA-256 digest obtained through a separately trusted channel. - Pin an installer version or reviewed artifact so its contents cannot silently change after audit. - Allow the user to inspect the downloaded script before explicitly executing it. - Document that installation should be performed as an unprivileged user and must not be prefixed with `sudo`. A safer workflow should follow this pattern: ```bash curl --proto '=https' --tlsv1.2 -fLo rustup-init.sh https://sh.rustup.rs sha256sum --check rustup-init.sh.sha256 sh rustup-init.sh ``` The checksum file and expected digest must come from an authenticated, trusted source and should be pinned to the reviewed installer release.