T03 · Remote Payload Retrieval and Execution
Error
- Location
- docs/LOCAL_SETUP_GUIDE.md:43
- Finding
- Setup documentation executes mutable remote installation scripts<![CDATA[ ## Vulnerability Details **File Location**: `docs/LOCAL_SETUP_GUIDE.md:43-45, 60-66, 78-85, 199-201`; `docs/archive/WSL最终落地方案.md:74-81` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # docs/LOCAL_SETUP_GUIDE.md:43-45 # Install Homebrew if it is not installed /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` ```bash # docs/LOCAL_SETUP_GUIDE.md:60-66 # Update the system sudo apt update && sudo apt upgrade -y # Install Node.js 22 curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt install -y nodejs ``` ```bash # docs/LOCAL_SETUP_GUIDE.md:78-85 sudo apt update sudo apt install -y curl # Install Node.js 22 curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt install -y nodejs ffmpeg ``` ```bash # docs/LOCAL_SETUP_GUIDE.md:199-201 curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up ``` ```bash # docs/archive/WSL最终落地方案.md:74-81 ## Phase 4: Install Cursor CLI inside WSL curl https://cursor.com/install -fsS | bash agent --version ``` ### Technical Analysis These commands send mutable network responses directly to a shell. The NodeSource variant executes the downloaded content through `sudo`, giving the remote script root privileges. The instructions do not pin an immutable release, verify a vendor signature, compare against a digest stored independently in this repository, or offer an inspection step before execution. Homebrew, NodeSource, Tailscale, and Cursor are relevant dependencies or vendors, but source-domain reputation does not remove the underlying time-of-check/time-of-use and supply-chain risk. The effective code executed by users can change after this project has been reviewed. The use of remote installers is not inherently required to manage `tmux`-backed Cursor tasks. The minimum necessary setup can instead use signed operating-system packages or separately downl ...[truncated 964 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `curl | bash` or command-substitution installer with a staged process: - Download a version-pinned artifact to a local file. - Obtain its expected digest or signature from an independent, authenticated source. - Verify the digest or signature locally. - Inspect the script before execution. - Run it without elevated privileges unless elevation is strictly necessary. 2. Prefer signed operating-system package repositories and package-manager installation procedures. 3. Pin installer versions or immutable commit identifiers instead of mutable `HEAD` or generic installer URLs. 4. Store expected checksums in this reviewed repository rather than downloading both the artifact and checksum from the same mutable source. 5. Explain which commands require elevation and avoid executing complete remote setup scripts as root. 6. Move the archived `curl | bash` instruction out of active documentation or mark it as unsafe legacy guidance. ]]>