T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/skill-install.sh:157
- Finding
- Mutable Remote Installation Scripts Are Executed Directly Through a Shell<![CDATA[ ## Vulnerability Details **File Location**: `scripts/skill-install.sh:157-160`; also documented in `README.md:19`, `README.md:27`, and `README.md:40` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Install CLI if not present if ! command -v supurr &>/dev/null; then info "Installing Supurr CLI..." curl -fsSL https://cli.supurr.app/install | bash else completed "Supurr CLI already installed: $(supurr --version 2>/dev/null || echo 'unknown')" fi ``` The same unsafe installation pattern is presented to users in `README.md`: ```bash curl -fsSL https://cli.supurr.app/skill-install | bash curl -fsSL https://cli.supurr.app/install | bash ``` ### Technical Analysis The installer downloads shell code from a mutable external URL and immediately passes it to `bash`. There is no version pinning, expected hash, digital-signature verification, content review step, or trusted local copy used for execution. HTTPS protects the connection in transit under normal conditions, but it does not guarantee that the server will continue serving the same content that was reviewed in this repository. Control of the web server, deployment pipeline, domain, DNS configuration, or associated credentials would allow the effective installation payload to be changed without modifying this audited project. This behavior is not required to install the checked-in Skill. A safer installation workflow can download a versioned artifact, authenticate it, and only then execute it. ### Attack Path 1. An attacker compromises `cli.supurr.app`, its deployment pipeline, DNS configuration, or release credentials. 2. The attacker replaces the response from `/install` or `/skill-install` with malicious shell commands. 3. A user follows the recommended `curl ... | bash` instructions, or runs `skill-install.sh` while the CLI is absent. 4. The attacker-controlled response is executed immediately by the user's shell. 5. Th ...[truncated 946 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every `curl | bash` installation path from scripts and documentation. 2. Publish immutable, versioned installer artifacts rather than mutable endpoint responses. 3. Download the installer to a temporary file without executing it: ```bash curl --proto '=https' --tlsv1.2 -fL \ -o supurr-install.sh \ https://cli.supurr.app/releases/vX.Y.Z/install.sh ``` 4. Publish an expected SHA-256 value through a separately authenticated release channel and verify it before execution: ```bash echo '<EXPECTED_SHA256> supurr-install.sh' | shasum -a 256 -c - ``` 5. Digitally sign release artifacts and verify the signature against a pinned public key. 6. Let users inspect the downloaded script before explicitly invoking it. 7. Pin documentation to a specific release rather than an unversioned endpoint. 8. Make signature or checksum failure fatal; never fall back to executing unverified content. ]]>