[Security] Usage of wget --no-check-certificates for downloading omvextras deb

OpenMediaVault-Plugin-Developers / installScript

script that installs omv-extras and openmediavault if not installed already.

1.1k stars 207 forks source link

[Security] Usage of wget --no-check-certificates for downloading omvextras deb #10

Closed 0xDAFE closed 4 years ago

0xDAFE commented 4 years ago

Hi there,

I have noticed that the install scripts downloads the omvextras deb package and explicitly ignores TLS certificate validation.

See code. wget --no-check-certificate ${url}/${file}

Unless I am overlooking something, integrity of the downloaded package is not checked otherwise so this would allow a MITM attacker to execute malicious code with root privileges on your system.

In my opinion, there is no valid reason for making this the default behavior.

ryecoaaron commented 4 years ago

Yep, while I don't think someone is going to MITM a home NAS user, this was a copy&paste error from my testing on a local server. Fixed.