T03 · Remote Payload Retrieval and Execution
Error
- Location
- INSTALL.md:27
- Finding
- Execution of a Mutable Remote Onboarding Script Without Mandatory Pre-Execution Verification## Vulnerability Details **File Location**: `INSTALL.md:27-28` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code:** ```bash curl -fsSL https://wundervault.com/onboard -o /tmp/wv-onboard.py python3 /tmp/wv-onboard.py "https://wundervault.com/setup/agent/TOKEN#PASSPHRASE" ``` ### Technical Analysis The installation procedure downloads a Python program from a mutable external URL and immediately instructs the user to execute it. Although downloading before execution is safer than directly piping `curl` into an interpreter, the effective security behavior remains remote payload retrieval followed by local code execution. The downloaded program is not included in the audited project, so its implementation and the claimed Ed25519 self-verification cannot be independently inspected as part of this audit. More importantly, verification performed by the downloaded program itself does not provide a reliable trust boundary if both the payload and its verification logic come from the same mutable endpoint. A modified payload could omit or bypass the claimed check. The documentation references a checksum and public key on another page, but the installation commands do not require users to verify either value before executing the program. The onboarding program also receives a setup URL containing a token and passphrase and reportedly writes credentials and modifies agent configuration, making the execution security-sensitive. ### Attack Path 1. An attacker compromises the onboarding endpoint, its deployment infrastructure, DNS resolution, or another component capable of controlling the response from `https://wundervault.com/onboard`. 2. The endpoint supplies a modified Python program. 3. A user follows the documented installation procedure and executes the downloaded file without first performing independent signature or checksum verification. 4. The malicious program receives the se ...[truncated 1239 chars]
- Remediation
- ## Remediation Suggestions 1. Include the onboarding script in the reviewed package so that its contents are available during security assessment. 2. If remote retrieval is required, use an immutable, versioned artifact URL rather than a mutable `/onboard` endpoint. 3. Pin the expected SHA-256 digest in `INSTALL.md` and make verification an explicit prerequisite: ```bash curl -fsSLo /tmp/wv-onboard.py https://wundervault.com/releases/onboard-vX.Y.Z.py printf '%s %s\n' 'EXPECTED_SHA256' '/tmp/wv-onboard.py' | sha256sum --check - python3 /tmp/wv-onboard.py 'SETUP_URL' ``` 4. Prefer detached signature verification by a trusted tool before Python executes the file. Embed or distribute the public key through a channel independent of the downloaded payload. 5. Abort installation when verification fails; do not present verification as optional. 6. Avoid exposing the setup secret in process arguments. Pass it through a protected file descriptor or restrictive temporary file and remove it immediately after use. 7. Run onboarding with the least-privileged user and explicitly document every file and configuration location it may modify.