T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:204- Finding
Downloaded Installer Executes When Integrity Verification Is Unavailable
- Content
View full analysis
/dev/null; then actual_checksum=$(sha256sum "${installer_name}" | awk '{print $1}') elif command -v shasum &> /dev/null; then actual_checksum=$(shasum -a 256 "${installer_name}" | awk '{print $1}') else log_warn "未找到 sha256sum/shasum 工具，跳过完整性校验" fi if [ -n "$actual_checksum" ]; then if [ "$actual_checksum" != "$expected_checksum" ]; then log_error "SHA256 校验失败！文件可能被篡改" log_error " 期望: ${expected_checksum}" log_error " 实际: ${actual_checksum}" rm -f "${installer_name}" exit 1 fi log_info "SHA256 校验通过" fi else log_warn "当前平台 ${platform_key} 无预置校验值，跳过完整性校验" fi echo "" echo -e "${YELLOW}即将执行已下载的安装器：${NC}" echo " 路径: ./${installer_name}" echo " 来源: ${installer_url}" echo " SHA256: 已校验通过" echo "" echo "该安装器将向系统写入 bdpan CLI 二进制（通常位于 ~/.local/bin）。" if [ "$force" = "yes" ]; then log_warn "检测到 --yes/--force，跳过最终确认（非交互模式）。" else read -p "是否现在执行安装器？[y/N] " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then log_info "已取消执行。安装器文件保留在当前目录：./${installer_name}" log_info "您可以先审查内容，或稍后手动执行：./${installer_name}" exit 0 fi fi # 执行安装器（非交互模式） ./${installer_name} --yes ``` ### Technical Analysis The installer is downloaded from an external CDN and executed locally. Although platform-specific SHA-256 values are embedded in the script, integrity verification fails open: 1. If neither `sha256sum` nor `shasum` is available, `actual_checksum` remains empty. 2. The sc ...[truncated 1837 chars]- Remediation
View remediation
/dev/null 2>&1; then actual_checksum=$(sha256sum "$installer_path" | awk '{print $1}') elif command -v shasum >/dev/null 2>&1; then actual_checksum=$(shasum -a 256 "$installer_path" | awk '{print $1}') else log_error "No SHA-256 implementation is available; refusing installation" exit 1 fi if [ "$actual_checksum" != "$expected_checksum" ]; then log_error "Installer checksum mismatch" exit 1 fi verified=true ``` 3. Print “SHA-256 verified” only when `verified=true`. 4. Download into a private temporary directory created by `mktemp -d`, use an absolute path, and set restrictive permissions on the directory. 5. Restrict redirects to HTTPS and, preferably, to the approved CDN host. 6. Consider verifying a cryptographically signed release manifest whose signing key is distributed independently from the CDN. ]]>