T08 · Insecure Dependencies
- Location
references/cli-installation-guide.md:16- Finding
Unverified and Unpinned Alibaba Cloud CLI and Plugin Installation
- Content
View full analysis
Vulnerability Details
File Locations:
references/cli-installation-guide.md:16-18references/cli-installation-guide.md:40-41SKILL.md:35-36
Vulnerability Type: Unverified remote executable and unpinned automatic plugin installation
Risk Level: MediumVulnerable Code
references/cli-installation-guide.md:16-18:bash curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar xz mkdir -p "$HOME/.local/bin" mv aliyun "$HOME/.local/bin/"references/cli-installation-guide.md:40-41:bash aliyun configure set --auto-plugin-install true aliyun plugin updateSKILL.md:35-36:bash aliyun configure set --auto-plugin-install true aliyun plugin updateTechnical Analysis
The installation instructions retrieve a mutable
latestarchive from an external endpoint, stream it directly intotar, and install the resulting executable without verifying a vendor signature or cryptographic checksum. Because the artifact is not pinned to a specific approved version, its contents can change after the Skill has been reviewed.The instructions also enable automatic plugin installation and run an unpinned plugin update. This permits plugin code that was not included in the audited project to be downloaded and executed later. The repository contains no evidence that the Alibaba Cloud endpoint or plugin channel is currently malicious; the vulnerability is the absence of controls that establish artifact identity and integrity.
HTTPS provides transport protection but does not independently protect against compromise of the vendor distribution infrastructure, release pipeline, DNS or certificate trust chain, or an upstream plugin package.
Attack Path
- An attacker compromises the CLI distribution endpoint, release pipeline, plugin channel, or a relevant part of the network trust chain.
- The attacker replaces the mutable
latestarchive ...[truncated 1362 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the Alibaba Cloud CLI to a specific reviewed version instead of using a mutable
latestURL. - Download the archive to a temporary file before extraction.
- Obtain a SHA-256 checksum or cryptographic signature through an authenticated vendor channel and verify it before extracting or executing the artifact.
- Abort installation if the expected version, checksum, signature, archive structure, or executable name does not match.
- Extract into a newly created private temporary directory and inspect the archive paths to prevent unexpected path traversal or file placement.
- Keep automatic plugin installation disabled by default. Install only explicitly required plugins at reviewed and pinned versions.
- Document an approved plugin source, expected versions, integrity values, and a controlled upgrade-review procedure.
- Prefer a trusted package manager with version pinning and package-signature verification where supported.
- Run installation and plugin updates with a minimally privileged local account and a least-privilege Alibaba Cloud profile.
A hardened installation flow should follow this pattern:
bash version="APPROVED_VERSION" archive="aliyun-cli-linux-${version}-amd64.tgz" expected_sha256="VENDOR_PUBLISHED_SHA256" curl -fL --proto '=https' --tlsv1.2 \ -o "$archive" \ "https://trusted-vendor.example/releases/${version}/${archive}" printf '%s %s\n' "$expected_sha256" "$archive" | sha256sum --check -The actual release URL and integrity value must come from an authenticated Alibaba Cloud release channel rather than being invented or derived from the downloaded archive itself.
- Pin the Alibaba Cloud CLI to a specific reviewed version instead of using a mutable