2

I wrote a batch script to install nuget from a fileshare. The script calls the following script in an elevated powershell prompt:

# Create dir
New-Item -ItemType Directory -Force -Path "C:\Program Files\Nuget"
# Download nuget
Invoke-WebRequest -O "C:\Program Files\Nuget\nuget.exe" https://dist.nuget.org/win-x86-commandline/latest/nuget.exe 
# Append to path
[Environment]::SetEnvironmentVariable("Path", $env:Path + ";C:\Program Files\Nuget", "Machine")

Could I be potentially introducing any security risks ? Someone could conquer the server and put any other .exe on there. What could be ways to improve the security, so that the script doesn't accidentally distribute malware. I could probably use the checksum, but will that be sufficient ?

4
  • "Can I be sure that the URL always points to the .exe that I really want to download?" - I think you can come up with the answer on your own. Give it a try!
    – gronostaj
    Commented Feb 2, 2021 at 10:41
  • 1
    Someone could conquer the server and put any *.exe on there, they want to :) I will adapt my question to focus more on the question what I could do instead Commented Feb 2, 2021 at 10:44
  • This question is a bit weird. I mean how can you be sure that anything that you download is not actually something else that just pretends to be what you want to have? I think you're overthinking this too much.
    – SimonS
    Commented Feb 2, 2021 at 14:36
  • Simple rule. If you cannot validate it, then don't use it. Trust is up to you. Anything can be bad, even if its intent is to be good. Think OS/phone updated, app updates, et all. All input can be evil, until it can be/is fully validated, no matter where/who it comes from.
    – postanote
    Commented Feb 2, 2021 at 19:53

1 Answer 1

1

Paranoia is good. But you should weigh the risk factor here, and use that to judge how much effort you should put into defending against a theoretical attack of this sort.

Point 1 -- nuget.org is a website owned and controlled by Microsoft (see the whois record). Could it be compromised? Sure, it could be. But the security that Microsoft puts around its websites in most cases is fairly high. I mean, this is the same company that you download Windows from, your patches, etc.

Point 2 -- Your script is just downloading the same file that is being downloaded (through other means) by (literally) thousands of other people every day. If nuget.org was compromised in this way, so many more people are going to get the file than through your script. It really, really, really wouldn't be due to any lack of security in your script.

Point 3 -- Who is to say that it hasn't already been compromised? Again, it's unlikely, but even if you were to download it, compute a checksum, and then check that against future downloads, you still have to trust that what is there now is safe. But again, I would consider this low risk. In addition to the security in place, it's likely that someone would notice a compromised nuget in some way before too long.

A checksum or signature would be nice-to-have, assuming it was posted on a separate site. But MS doesn't appear to provide a checksum/hash for nuget.exe releases that I can see. Oddly, it's my understanding that nuget supports checking the hash of packages that it downloads, but there's no way that I see to confirm the exe in the first place.

2
  • Thank you for your answer. I was just unsure, because I wrote the script quickly without wasting any thought on security and later it came to my mind, that I possibly could be introducing a security risk. In this case I either have to put the nuget.exe statically somewhere or I use this script, which relies on trust onto the existing security in place Commented Feb 3, 2021 at 7:12
  • The thing that also raised a red fleg to my mind was the elevated prompt which I use to copy the file to C:\Program Files Commented Feb 3, 2021 at 7:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .