T03 · Remote Payload Retrieval and Execution
Warning
- Location
- tools/ggb-export/page.html:6
- Finding
- Unpinned Remote JavaScript Is Executed During GeoGebra Export## Vulnerability Details **File Location**: `tools/ggb-export/page.html:6` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://www.geogebra.org/apps/deployggb.js"></script> ``` ### Technical Analysis The local export page loads and executes JavaScript directly from the official GeoGebra website. The resource URL is not pinned to a fixed release, verified with a cryptographic digest, or protected by Subresource Integrity. Consequently, the code executed by the export workflow can change after the Skill package has been reviewed. The use of GeoGebra's official domain lowers the likelihood of abuse, but it does not eliminate supply-chain risks arising from an upstream compromise, account compromise, deployment error, or compromised delivery infrastructure. This remote dependency is integral to the declared GeoGebra export functionality, but executing a mutable remote payload is not the minimum-risk implementation. A fixed, locally audited engine release would provide the same functionality with a substantially smaller trust boundary. The loaded script executes in the browser page used by `tools/ggb-export/export_ggb.mjs`. That page receives generated GeoGebra commands through browser runtime evaluation and produces Base64-encoded `.ggb` data that the Node.js process writes to the requested output path. Remote code controlling the page can therefore observe or modify construction data and influence the exported artifact. ### Attack Path 1. An attacker compromises the upstream `deployggb.js` resource, its publishing account, or its delivery infrastructure. 2. A user runs the documented local export workflow. 3. The headless Chrome or Edge instance opens `page.html` and retrieves the modified script from `https://www.geogebra.org/apps/deployggb.js`. 4. The attacker-controlled JavaScript executes in the export page. 5. The ...[truncated 1429 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor a reviewed, fixed GeoGebra deployment script and all required engine assets inside the Skill package. 2. Pin the vendored assets to a documented GeoGebra release and record cryptographic SHA-256 hashes for release verification. 3. If remote loading is unavoidable, use a version-specific immutable URL and Subresource Integrity with an exact expected digest, provided the server supports compatible cross-origin delivery. 4. Add a restrictive Content Security Policy that permits scripts only from the selected local or pinned source and limits outbound connections with `connect-src`. 5. Fail closed when integrity verification fails; do not silently fall back to an unpinned latest-version resource. 6. Document that the export step currently requires remote code execution and may expose construction content to code served by the upstream domain. 7. Add automated tests that verify dependency hashes before launching the browser and before every release. 8. Consider blocking nonessential outbound network access after all verified engine assets have loaded.