T08 · Insecure Dependencies
- Location
references/everything-cli.ps1.txt:318- Finding
Unverified Download and Execution of a Cached Third-Party Executable
- Content
View full analysis
Vulnerability Details
File Location:
references/everything-cli.ps1.txt, lines 318–339 and 379–382
Vulnerability Type: Unverified third-party executable download and cached-binary trust
Risk Level: MediumVulnerable Code
powershell function Ensure-EsCli { param([string]$EverythingExePath) if (Test-Path -LiteralPath $EsPath -PathType Leaf) { return (Resolve-Path -LiteralPath $EsPath).Path } New-Item -ItemType Directory -Force -Path $VendorRoot | Out-Null $arch = Get-EsArchitecture -EverythingExePath $EverythingExePath $zipName = "ES-$EsVersion.$arch.zip" $zipPath = Join-Path $VendorRoot $zipName $downloadUrl = "https://www.voidtools.com/$zipName" Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath Expand-Archive -LiteralPath $zipPath -DestinationPath $VendorRoot -Force Remove-Item -LiteralPath $zipPath -Force if (-not (Test-Path -LiteralPath $EsPath -PathType Leaf)) { throw "Downloaded $downloadUrl but es.exe was not found after extraction." } return (Resolve-Path -LiteralPath $EsPath).Path }The resulting executable is subsequently invoked as follows:
powershell $outputLines = & $esCliPath @EsArguments 2>&1 $exitCode = $LASTEXITCODE $outputText = ($outputLines | ForEach-Object { $_.ToString() }) -join [Environment]::NewLineTechnical Analysis
The skill downloads an archive containing
es.exefrom an external HTTPS endpoint and executes the extracted binary. Although the version and official voidtools hostname are fixed, the implementation does not verify a pinned cryptographic digest, an Authenticode signature, or the expected publisher before execution.The function also returns immediately when an executable already exists at
$EsPath. Consequently, an existing cached binary is trusted solely because a file occupies the expected path. No integrity or provenance check is applied on initial download or subsequent invocations.HTTPS pro ...[truncated 1492 chars]
- Remediation
View remediation
Remediation Suggestions
- Publish and pin a SHA-256 digest for every supported architecture and exact
es.exeversion. - Download the archive to a newly created temporary file rather than directly into its final cache location.
- Verify the archive digest using a constant-time or standard platform comparison before extraction.
- Reject and delete the archive if verification fails.
- Extract into a newly created staging directory and verify that only expected files are present.
- Verify the extracted executable's Authenticode signature and require the expected trusted publisher where a suitable signature is available.
- Validate existing cached copies on every invocation rather than trusting file existence. Remove or quarantine any binary that fails validation.
- Atomically move the validated executable from the staging directory into the final cache location.
- Apply access controls to the cache directory so it is writable only by the intended user and not by lower-trust principals.
- Consider bundling a reviewed, integrity-pinned executable with the release or using an authenticated package-management mechanism with lockfile and hash verification.
- Fail closed: never execute the binary when its digest, signature, version, architecture, or expected location cannot be validated.
- Publish and pin a SHA-256 digest for every supported architecture and exact