T08 · Insecure Dependencies
Warning
- Location
install.sh:110- Finding
Unpinned and Unverified Third-Party Dependency Installation
- Content
View full analysis
=2.0.0 openpyxl>=3.1.0 ``` ### Technical Analysis The installer invokes pip after explicit user opt-in, but the dependency requirements use open-ended minimum versions. There are no exact version pins, upper bounds, package hashes, or lock file. Consequently, installation results depend on the packages available from the configured Python package index at execution time. A future compromised, malicious, or incompatible dependency release could be selected without any project change or renewed review. Python package installation may execute package build logic under the privileges of the user running the installer. The installer does not silently install dependencies, does not use suspicious package names, and does not configure an untrusted package index. These controls reduce likelihood but do not provide dependency integrity or reproducibility. ### Attack Path 1. An attacker compromises the distribution account or release pipeline of a declared dependency, or otherwise causes a malicious compatible version to appear on the package index used by pip. 2. The user runs: ```bash bash install.sh --target /chosen/path --install-dependencies ``` 3. Pip resolves the open-ended requirement to the attacker-controlled compatible release. 4. Package installation or build logic executes with the installing user's privileges. 5. The malicious dependency can access data and resources available to that user, including workbooks later processed in the same environment. ### Impact Assessment ...[truncated 478 chars]- Remediation
View remediation
openpyxl== ``` 2. Generate a lock file containing hashes for all direct and transitive dependencies. 3. Install with hash verification: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Periodically update dependencies through a controlled review process that includes vulnerability scanning and regression testing. 5. Recommend installation inside a dedicated virtual environment rather than the system Python environment. 6. Avoid running dependency installation with administrator or root privileges. 7. Document the expected Python package index and advise users to verify that pip is not configured to use an unauthorized index or proxy. ]]>