"One-click self-update" vulnerability challenge

[Obsidian]

Note: this lesson encompasses a bit of programming theory...

I was doing some digging into a ever-so-popular web application which will remain unidentified for the time being (to not spoil the solution to this challenge) to figure out how it was handling its much-touted "one-click self-update".
Internally, it polls a remote API (served over HTTP) for updates, then notifies the administrator and asks to download. If given consent by the site administrator, it will then download a ZIP archive and then attempt to unpack its files and overwrite local files with those provided in the ZIP.

As a hint, the URL to the remote ZIP archive is like follows:

Code: Select all

http://www.popularsoftwaredomain.tld/software-versionstamp.zip

In a spoiler'd reply, identify the vulnerability, and if you can (in a separate spoiler) provide a solution that protects against the attack vector.

Hint:

Spoiler:

Think: remote code execution

[Obsidian]

Another hint:

Spoiler:

[Techie-Micheal]

Spoiler:

I wondered if you were talking about that ...

Spoiler:

SSL of course is a given. Providing checksums is also a good idea.

Now go answer mine.

[Obsidian]

Spoiler:

I wondered if you were talking about that ...

Spoiler:

SSL of course is a given. Providing checksums is also a good idea.

Now go answer mine.

Spoiler:

SSL would *help*, assuming there's no nasty coverall ssl certs laying around.

Checksums wouldn't matter unless they're also securely distributed, though.

Best solution is code signing.

Also, for the record, the software that contains this opening?

Spoiler:

None other than WordPress of course, as of the latest versions - 3.3.0 and 3.3.1!