T03 · Remote Payload Retrieval and Execution
Error
- Location
- smithnode-core/src/main.rs:1568
- Finding
- Automatic Remote Binary Replacement and Execution<![CDATA[ ## Vulnerability Details **File Location**: `smithnode-core/src/main.rs:1568-1822` **Vulnerability Type**: Unattended remote software download, executable replacement, and process re-execution **Risk Level**: Critical ### Vulnerable Code ```rust match reqwest::get(try_url).await { Ok(response) if response.status().is_success() => { match response.bytes().await { Ok(bytes) => { use sha2::{Sha256, Digest}; let mut hasher = Sha256::new(); hasher.update(&bytes); let computed_checksum = hex::encode(hasher.finalize()); if computed_checksum != checksum { tracing::warn!("⚠️ [{}] Checksum mismatch from {}", source, try_url); continue; } downloaded_bytes = Some(bytes.to_vec()); download_success = true; break; } Err(e) => { tracing::warn!("⚠️ [{}] Failed to read response: {}", source, e); continue; } } } Ok(response) => { tracing::warn!("⚠️ [{}] HTTP {}", source, response.status()); continue; } Err(e) => { tracing::warn!("⚠️ [{}] Download failed: {}", source, e); continue; } } let bytes = downloaded_bytes.unwrap(); match std::env::current_exe() { Ok(current_exe) => { let backup_path = current_exe.with_extension("old"); let new_path = current_exe.with_extension("new"); if let Err(e) = std::fs::write(&new_path, &bytes) { tracing::error!("❌ Failed to write new binary: {}", e); applied_version = Some(upgrade.version.clone()); continue; } #[cfg(unix)] { use std::os::unix::fs::PermissionsExt; let _ = std::fs::set_permissions( &new_path, std::fs::Permissions::from_mode(0o755), ); ...[truncated 3120 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove automatic executable replacement and re-execution from the validator. - Require an explicit administrator action before installing every release. - Use reproducible builds and publish verifiable source-to-binary attestations. - Require threshold signatures from multiple independently controlled release keys. - Pin allowed release origins and require HTTPS without unsafe redirects. - Stage updates in an isolated directory and verify signatures using an offline release root. - Run update installation through a separate, narrowly privileged updater that cannot read validator keys. - Provide a configuration option that disables remote updates by default. - Add release-key rotation and revocation procedures. ]]>