Security: executable archives downloaded over plain HTTP with hash verification disabled (nohash) - MITM code execution #4954

Security report (responsible disclosure)

Executable archives fetched over plain HTTP with hash verification disabled (nohash) — MITM code execution

Affected files:

• lgsm/modules/core_steamcmd.sh:17-19
• lgsm/modules/update_mta.sh:12-13
• lgsm/modules/command_install_resources_mta.sh:17-18

fn_fetch_file "http://media.steampowered.com/client/steamcmd_linux.tar.gz" "" "" "" "${tmpdir}" "steamcmd_linux.tar.gz" "nochmodx" "norun" "noforce" "nohash"
fn_dl_extract "${tmpdir}" "steamcmd_linux.tar.gz" "${steamcmddir}"
chmod +x "${steamcmddir}/steamcmd.sh"

fn_fetch_file "http://linux.mtasa.com/dl/multitheftauto_linux_x64.tar.gz" ... "force" "nohash"

Chain

curl -L over plain HTTP (core_dl.sh:445) on first steamcmd install and on MTA updates → nohash bypasses fn_dl_hash entirely (core_dl.sh:217) → archive extracted into ${steamcmddir} / ${serverfiles} → steamcmd.sh is chmod +x'd and executed by every subsequent update/start; MTA binaries run at server start, and MTA resources execute as Lua inside the game server.

Any network attacker on path (or DNS hijack — no TLS involved) replaces the payload and gets shell execution as the LinuxGSM user, re-triggered automatically by update crons.

Severity

High — unauthenticated network position → persistent code execution.

Suggested fix

Serve both URLs over HTTPS (both hosts support it), and pin sha256 checksums the way install_server_files.sh already does for its tarballs. The existing MD5 pinning there is better than nothing but sha256 would be the modern baseline.