Summary
Software update checks and auto-install both default to on:
enabled = values.get("enabled", True)
auto_install = values.get("auto_install", True)Every 10 minutes the watcher fetches @{upstream} and, if the checkout is a clean fast-forward of main, runs scripts/install (or install-linux). There is no origin allowlist and no tag/commit signature check. Origin is whatever the managed checkout tracks.
The Windows README bootstrap has the same class of problem: Invoke-WebRequest of raw.githubusercontent.com/splunk/token-meter/main/scripts/bootstrap-windows.ps1 with no hash pin.
Impact
Compromise of GitHub main, a force-push, or a user who cloned a fork and then turned this on becomes arbitrary code execution as that user, including rewrite of the systemd/LaunchAgent units.
Fast-forward-only + “must be on main” is a useful guard against local dirty/diverged state. It is not an authenticity check.
Suggested fix
- Default
auto_install to off (keep periodic checks if you want).
- Before fetch/install, require
origin to be https://github.com/splunk/token-meter.git (and the ssh equivalent).
- Prefer signed tags.
- Pin the Windows bootstrap script by hash, or stop fetching it from
raw.githubusercontent.com as the documented install path.
Summary
Software update checks and auto-install both default to on:
Every 10 minutes the watcher fetches
@{upstream}and, if the checkout is a clean fast-forward ofmain, runsscripts/install(orinstall-linux). There is no origin allowlist and no tag/commit signature check. Origin is whatever the managed checkout tracks.The Windows README bootstrap has the same class of problem:
Invoke-WebRequestofraw.githubusercontent.com/splunk/token-meter/main/scripts/bootstrap-windows.ps1with no hash pin.Impact
Compromise of GitHub
main, a force-push, or a user who cloned a fork and then turned this on becomes arbitrary code execution as that user, including rewrite of the systemd/LaunchAgent units.Fast-forward-only + “must be on
main” is a useful guard against local dirty/diverged state. It is not an authenticity check.Suggested fix
auto_installto off (keep periodic checks if you want).originto behttps://github.com/splunk/token-meter.git(and the ssh equivalent).raw.githubusercontent.comas the documented install path.