T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/install.sh:60
- Finding
- Mutable Remote Shell Scripts Are Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:60-75` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash macos) if command -v brew >/dev/null 2>&1; then info "Installing Node.js LTS via Homebrew..." brew install node@22 brew link --overwrite node@22 2>/dev/null || true else info "Installing Node.js LTS via install-node.vercel.app..." curl -fsSL https://install-node.vercel.app/lts | bash -s -- --yes fi ;; linux) if command -v apt-get >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (apt)..." curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt-get install -y nodejs elif command -v yum >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (yum)..." curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo -E bash - sudo yum install -y nodejs else info "Installing Node.js LTS via install-node.vercel.app..." curl -fsSL https://install-node.vercel.app/lts | bash -s -- --yes fi ``` ### Technical Analysis The installer pipes network responses directly into Bash. The effective code is therefore not the code reviewed in this project: it is mutable content controlled by external hosting infrastructure at installation time. No version-pinned script, cryptographic checksum, detached signature, or package provenance verification is performed. The NodeSource branches additionally execute the downloaded response through `sudo -E bash`, granting it administrative privileges while preserving parts of the caller's environment. HTTPS protects the connection in transit but does not establish that the response matches a previously audited artifact. Compromise of the remote host, its deployment pipeline, DNS resolution, or a trusted certificate authority could alter the executed payload. ### Attack Path 1. A user runs `scripts/install.sh` on a host where Node.js ...[truncated 1064 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every `curl | bash` construction. 2. Prefer official operating-system package repositories or instruct users to install Node.js independently. 3. If automated download is necessary: - Pin an exact artifact version. - Download it to a newly created, permission-restricted temporary directory. - Verify an embedded SHA-256 or stronger digest. - Verify the publisher's detached signature using a pinned public key. - Abort on any verification failure. - Execute only the verified local artifact. 4. Avoid running downloaded setup scripts with `sudo`; isolate privileged package-manager operations from untrusted network content. 5. Do not preserve the caller's environment through `sudo -E` unless each inherited variable is explicitly required and validated. 6. Publish the expected checksums and signing-key fingerprints through an independently authenticated release channel. ]]>