← All KD5FMU repositories

ASL3_Multi_App_Install

https://github.com/KD5FMU/ASL3_Multi_App_Install · Shell · 3 findings · Review date 2026-07-11

Executive Summary

3 finding(s) including 1 critical. Meta-installer downloads and executes remote installers over HTTP without checksums.

![MAPI Logo](https://github.com/KD5FMU/ASL3_Multi_App_Install/blob/main/MAIS.png)

Summary Counts

1
Critical Security
2
High Security
0
Medium Security
0
Low Security
0
Critical Bugs
0
High Bugs
0
Medium Bugs
0
Low Bugs

Quick Reference

IDSeverityCategoryFileLinesFinding
MAPP-001 Critical Security m_app.sh 240-258 Downloads and executes remote installers over HTTP without verification
MAPP-002 High Security m_app.sh 206-215 Runs downloaded AllScan PHP installer directly
MAPP-003 High Security m_app.sh 374-392 Injects wide SkywarnPlus DTMF control functions into rpt.conf

Critical Security Issues

[MAPP-001] Downloads and executes remote installers over HTTP without verification

m_app.sh : 240-258

Supermon and DVSwitch installers downloaded over HTTP and executed as root.

Impact: MITM or compromised host serves malicious code on AllStar nodes.

High Security Issues

[MAPP-002] Runs downloaded AllScan PHP installer directly

m_app.sh : 206-215

AllScanInstallUpdate.php wget'd from GitHub and executed with ./.

Impact: Compromised upstream PHP installer runs as root.

[MAPP-003] Injects wide SkywarnPlus DTMF control functions into rpt.conf

m_app.sh : 374-392

sed-inserts SkyControl.py and SkyDescribe.py DTMF commands without warning.

Impact: Radio users can toggle SkywarnPlus features by DTMF.

Recommended Fix Priority

  1. Address all Critical findings before production deployment
  2. Use HTTPS with checksum verification for remote downloads