T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/download_weights.py:69- Finding
Unverified Remote Executable Download and Execution
- Content
View full analysis
Vulnerability Details
File Location:
scripts/download_weights.py, lines 69–92 and 123–128
Vulnerability Type: Remote payload retrieval and execution without integrity verification
Risk Level: HighVulnerable Code
python # Install to ~/.local/bin local_bin = os.path.expanduser("~/.local/bin") pget_path = os.path.join(local_bin, "pget") if os.path.isfile(pget_path) and os.access(pget_path, os.X_OK): return pget_path os.makedirs(local_bin, exist_ok=True) sysname = platform.system() machine = platform.machine() if machine == "aarch64": machine = "arm64" elif machine == "x86_64": machine = "x86_64" # Replicate releases: pget_Linux_x86_64, pget_Darwin_arm64, etc. asset = f"pget_{sysname}_{machine}" url = f"{PGET_RELEASE}/{asset}" try: req = urllib.request.Request(url, headers={"User-Agent": "ComfyUI-Skill/1.0"}) with urllib.request.urlopen(req, timeout=60) as resp: with open(pget_path, "wb") as f: f.write(resp.read()) os.chmod(pget_path, 0o755) return pget_path except Exception as e: print(f"Could not install pget ({e}); falling back to built-in download.", file=sys.stderr) return Nonepython def download_with_pget(manifest_path: str, pget_bin: str, overwrite: bool) -> bool: cmd = [pget_bin, "multifile", manifest_path] if overwrite: cmd.append("-f") r = subprocess.run(cmd) return r.returncode == 0Technical Analysis
When
pgetis unavailable, the script automatically retrieves a native executable from a mutable GitHublatest/downloadURL, writes it to~/.local/bin/pget, grants it executable permissions, and subsequently launches it withsubprocess.run().The downloaded executable is not pinned to a specific release and is not authenticated using a hard-coded cryptographic digest or trusted digital signature. HTTPS protects data in transit but does not inde ...[truncated 1743 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not automatically install or execute
pget; use the built-in Python downloader by default. - Require explicit user consent before downloading any executable dependency.
- Pin
pgetto a specific reviewed release version rather than usinglatest. - Maintain a platform-specific allowlist of expected SHA-256 hashes and verify the complete artifact before granting execute permission.
- Prefer verification using a trusted publisher signature in addition to hash validation.
- Download to a securely created temporary file, validate it, and then atomically move it into place.
- Reject redirects to origins outside an explicit allowlist.
- Remove an incomplete or invalid artifact after any download or verification failure.
- Document the external executable, its source, version, integrity controls, and execution behavior in the Skill documentation.
- Run model downloads with the lowest practical filesystem and operating-system privileges.
- Do not automatically install or execute