T08 · Insecure Dependencies
Error
- Location
install.sh:11- Finding
Unpinned Dependencies Permit Supply-Chain Code Execution
- Content
View full analysis
=1.30.0 jsonschema>=4.22.0 matplotlib>=3.8.0 ``` ### Technical Analysis The installation script upgrades `pip` and installs dependencies using open-ended minimum-version constraints. These constraints allow pip to resolve any later version published under the listed package names. Consequently, the effective code installed and executed is not fixed to the code reviewed during this audit. A compromised maintainer account, malicious future release, package-index compromise, or dependency takeover could cause an attacker-controlled package version to be selected during installation. Python packages may execute code as part of their build or installation process, and imported packages execute module initialization code at runtime. The absence of a lock file and cryptographic hashes also prevents users from verifying that they received the exact artifacts tested by the project. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, or the package-distribution channel. 2. The attacker publishes a malicious version that satisfies the project's lower-bound requirement. 3. A user runs `install.sh`. 4. Pip resolves and downloads the malicious release because no exact version or artifact hash is enforced. 5. Malicious package code executes during installation, build, or subsequent import. 6. The payload runs with the privileges of the user performing the installation. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the installing user's account. This may expose environment variables, source code ...[truncated 374 chars]- Remediation
View remediation