T03 · Remote Payload Retrieval and Execution
Error
- Location
- DEPENDENCIES.md:17
- Finding
- Mutable Remote Installation Script Executed with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `DEPENDENCIES.md:17-20` **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: Critical ### Vulnerable Code ```bash **Install if needed:** - macOS: `brew install node` - Ubuntu: `curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs` - Windows: Download from https://nodejs.org ``` ### Technical Analysis The Ubuntu installation instructions download a mutable shell script from an external URL and immediately pipe it into `sudo bash`. The retrieved payload is not pinned to a specific version and is not verified using a cryptographic hash or trusted package signature before execution. Because the downloaded script executes with root privileges, its effective capabilities are not limited to installing Node.js. It can modify any system file, install services, create users, access locally stored data, or install additional software. The payload returned by the external server can also change after this Skill has been audited. This is classified as remote payload retrieval and execution even though the currently intended NodeSource script may be legitimate. The unsafe property is that the code actually executed by the user is externally controlled and cannot be established from the reviewed project. ### Attack Path 1. A user follows the documented Ubuntu installation instructions. 2. `curl` retrieves the current response from `https://deb.nodesource.com/setup_20.x`. 3. The response is passed directly to `sudo -E bash -` without local inspection or integrity verification. 4. If the upstream publishing account, server, DNS resolution, TLS trust path, or delivery infrastructure is compromised, the response can contain attacker-controlled shell commands. 5. Those commands execute as root. 6. The attacker can modify the operating system, steal credentials, install persistence, or compromise subsequent wallet operations. ### Impact Assessm ...[truncated 513 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sudo bash` pipeline from the documentation. 2. Prefer the operating system's signed Node.js packages where an acceptable version is available. 3. If NodeSource must be used: - Download a version-pinned installer or repository configuration file without executing it. - Verify its cryptographic hash or upstream signature. - Inspect the downloaded content before execution. - Execute only the minimum commands required to configure the repository. 4. Avoid preserving unnecessary environment variables through `sudo -E`. 5. Document the exact trusted signing key fingerprint and package verification procedure. 6. Prefer reproducible container or development-environment definitions that pin the Node.js distribution and digest. ]]>