OTA updater trusts the git host and registry with no signature or digest check — a compromised Gitea is root on every node #17

New Issue

2026-10-04T01:11:46-04:00

logan commented

2026-10-04 01:11:46 -04:00

Found during the security review of node-26#16 (the host updater for #15).

scripts/drb-update.sh runs as root. It checks out the configured ref (v1) from git.vpn.cusano.net, runs scripts/install-updater.sh from that checkout, and pulls images from the same host. The guards in #16 stop C2 from choosing what gets installed: the reply is a timestamp only, and origin and registry must match /etc/drb/updater.conf. But nothing verifies what the git host or registry actually serves:

tags are unsigned, and git fetch --force accepts a moved tag
images are pulled by mutable tag (:latest, :stable), not by digest

The git host is also a dynamic-DNS box on the owner's home uplink (install.sh D1). Whoever controls it, or the account that can push v1, gets root on the whole fleet the next time someone presses Update or a timer fires. There is precedent: INCIDENT-2026-08-11 was an RCE attempt on this same Gitea.

Fix direction:

sign release tags (git verify-tag against a key baked into install.sh)
pin images by digest in a signed release manifest, or use cosign
drb-update.sh refuses any update that fails verification

Not fixed in #16 because it needs a release-signing process (key custody) that the owner has to own.

Found during the security review of node-26#16 (the host updater for #15). `scripts/drb-update.sh` runs as root. It checks out the configured ref (`v1`) from `git.vpn.cusano.net`, runs `scripts/install-updater.sh` from that checkout, and pulls images from the same host. The guards in #16 stop **C2** from choosing what gets installed: the reply is a timestamp only, and origin and registry must match `/etc/drb/updater.conf`. But nothing verifies **what the git host or registry actually serves**: - tags are unsigned, and `git fetch --force` accepts a moved tag - images are pulled by mutable tag (`:latest`, `:stable`), not by digest The git host is also a dynamic-DNS box on the owner's home uplink (install.sh D1). Whoever controls it, or the account that can push `v1`, gets root on the whole fleet the next time someone presses Update or a timer fires. There is precedent: INCIDENT-2026-08-11 was an RCE attempt on this same Gitea. Fix direction: - sign release tags (`git verify-tag` against a key baked into install.sh) - pin images by digest in a signed release manifest, or use cosign - `drb-update.sh` refuses any update that fails verification Not fixed in #16 because it needs a release-signing process (key custody) that the owner has to own.

logan referenced this issue

2026-10-04 01:12:07 -04:00

Node enrolled via install.sh never comes online if approved after install (Toughny) — no client-side key pickup, and re-run doesn't restart edge-node #14

logan referenced this issue

2026-10-04 01:12:07 -04:00

"Update Node" is not an OTA update — it only restarts the container, and only reaches nodes already on MQTT #15

logan referenced this issue

2026-10-04 18:10:07 -04:00

Pin node images to the checked-out source tree — fix v1 code / :latest image skew (#19) #31

logan referenced this issue

2026-10-04 18:10:37 -04:00

Code/image skew (install.sh D3): updater checks out v1 code but pulls :latest images built from main #19