T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/release-package.md:47
- Finding
- Unverified Remote Retrieval and Execution of the Flydb CLI Release<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-54`; `references/release-package.md:7-13, 47-56`; `references/upstream-sync.json:2-6` **Vulnerability Type**: Remote payload retrieval and execution without mandatory authenticity verification **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:51-54`: ```markdown 1. 探测已有安装：先查用户给定路径、`FLYDB_HOME`、PATH 和项目工具目录，再按需搜索常见安装位置。 2. 复用本地 ZIP（如 `~/Downloads/flydb-cli-*.zip`），`unzip` 解压 3. 下载：GitHub URL 模式 `https://github.com/zzxCoding/Flydb/releases/download/v<version>/flydb-cli-<version>.zip`；国内网络 GitHub 不可达时用 Gitee 镜像同型 URL `https://gitee.com/zzhenxuan/Flydb/releases/download/v<version>/flydb-cli-<version>.zip` ``` `references/release-package.md:47-56`: ```bash # FLYDB_VERSION 由用户指定或从已核验的 Release 选定，不从源码 pom 自动推断 : "${FLYDB_VERSION:?先选择已核验的发行版本}" curl -fL -o "flydb-cli-${FLYDB_VERSION}.zip" \ "https://github.com/zzxCoding/Flydb/releases/download/v${FLYDB_VERSION}/flydb-cli-${FLYDB_VERSION}.zip" # GitHub 不可达且镜像确有同版本资产时，改用上述 Gitee URL 模式 ``` ```markdown 下载后先 `unzip -t` 检查完整性；Release 提供校验文件时核对其中同名 ZIP 的 SHA-256（macOS `shasum -a 256`，Linux `sha256sum`）。只有自己计算的哈希不能证明来源一致。选择一个精确版本 ZIP，避免通配符混入多个版本。缺少可信校验值时如实报告验证范围。 ``` `references/upstream-sync.json:2-6`: ```json { "source_repository": "https://github.com/zzxCoding/Flydb", "source_commit": "56bc3baef4a4e5c9eefe440644a4343aa960d0a4", "source_version": "0.3.6", "source_inputs_dirty": false, "source_input_status": [], "release_status": "not_verified" } ``` ### Technical Analysis The Skill instructs the Agent to download a ZIP containing executable shell launchers and Java JARs from an external repository and then execute the extracted CLI. This creates a remote code-execution channel whose effective payload may change after the Skill itself has been reviewed. The documented safeguards do not provide mandatory authenticity verification: - `curl -fL` provides transport-level error handling but does not authenticate the release publ ...[truncated 2729 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Fail closed on authenticity verification** - Do not extract or execute a downloaded release unless it matches trusted verification material. - Treat missing signatures or trusted checksums as a blocking error rather than merely reporting reduced verification. 2. **Pin approved release metadata** - Include an allowlist of approved versions and SHA-256 hashes in the reviewed Skill package. - Bind each hash to the exact asset name, release version, and source URL. - Update this manifest only through a reviewed release process. 3. **Use signed release manifests** - Publish checksums in a cryptographically signed manifest. - Pin the expected signing key or certificate fingerprint in the Skill. - Verify the signature and then verify the ZIP against the signed checksum before extraction. 4. **Secure mirror fallback** - Require the GitHub and Gitee assets to match the same trusted signed digest. - Do not treat URL naming consistency as proof that mirror assets are equivalent. - Document and verify the ownership relationship between both release locations. 5. **Harden extraction** - Extract into a newly created, non-privileged directory. - Reject absolute paths, parent-directory traversal entries, device files, and unsafe symbolic links. - Avoid overwriting an existing installation. 6. **Reduce execution privileges** - Run release verification and initial execution without elevated operating-system privileges. - Use a database account scoped to the required schema and migration operations. - Avoid exposing unrelated secrets or broad environment variables to the CLI process. ]]>