T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:75- Finding
Remote Alibaba Cloud CLI installer is executed without integrity verification
- Content
View full analysis
= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see `references/cli-installation-guide.md` for installation instructions. ``` ### Technical Analysis The command streams the current response from an external URL directly into Bash. No fixed installer version, cryptographic checksum, signature verification, certificate pinning, or manual inspection step is required. Although the hostname appears associated with Alibaba Cloud, hostname appearance alone does not establish the integrity of the response. The effective code can change after the Skill has been reviewed. Compromise of the origin, CDN, DNS resolution, TLS trust chain, or release infrastructure could therefore turn this installation instruction into an arbitrary-code execution channel. Updating the Alibaba Cloud CLI may be a legitimate prerequisite, but direct pipe-to-shell execution is not necessary for the Skill's declared cloud-management functionality. ### Attack Path 1. The Skill checks the installed Alibaba Cloud CLI version. 2. The CLI is absent or older than version 3.3.3. 3. The Agent follows the documented update instruction. 4. `curl` retrieves the current contents of `setup.sh`. 5. Bash executes the response immediately without verifying its contents. 6. A compromised or unexpectedly modified response executes arbitrary commands with the privileges of the user running the Agent. ### Impact Assessment A malicious installer would receive the Agent user's local privileges. Depending on that user's access, it could: - Read or alter local files available to the user. - Access Alibaba Cloud CLI configuration and credentials av ...[truncated 462 chars]- Remediation
View remediation