T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:1167
- Finding
- Unauthenticated Go pprof Server Exposed on All Network Interfaces## Vulnerability Details **File Location**: `SKILL.md`, lines 1167-1175 **Vulnerability Type**: Unauthenticated diagnostic endpoint exposure **Risk Level**: Medium ```go import _ "net/http/pprof" // In main.go (debug server on separate port) go func() { log.Println(http.ListenAndServe(":6060", nil)) }() // Then: go tool pprof http://localhost:6060/debug/pprof/heap // Or: go tool pprof http://localhost:6060/debug/pprof/profile?seconds=30 ``` ### Technical Analysis The example imports `net/http/pprof`, which registers profiling handlers on Go's default HTTP multiplexer. It then starts an HTTP server using `http.ListenAndServe(":6060", nil)`. The empty host in `:6060` causes the service to listen on all available network interfaces, while the `nil` handler selects the default multiplexer containing the pprof endpoints. No authentication, authorization, request throttling, network restriction, or configuration gate protects the profiling interface. If an agent incorporates this example into a service deployed without restrictive firewall rules, remote clients may access endpoints such as heap, goroutine, allocation, and CPU profiles. This exposure is not required for normal production service operation and exceeds minimum privilege by making an internal diagnostic facility network-accessible by default. ### Attack Path 1. A service is generated or modified using the documented profiling example. 2. The service starts a listener on `0.0.0.0:6060` and potentially `[::]:6060`. 3. Deployment networking, a container port mapping, or permissive firewall rules makes port 6060 reachable by an untrusted client. 4. The client requests endpoints such as `/debug/pprof/heap`, `/debug/pprof/goroutine`, or `/debug/pprof/profile?seconds=30`. 5. The client collects runtime diagnostic information or repeatedly requests expensive profiles to consume CPU and other service resources. ### Impact Assessment An attacker does ...[truncated 576 chars]
- Remediation
- ## Remediation Suggestions - Disable profiling by default and require an explicit development or diagnostics configuration flag before starting it. - Bind the listener to a loopback address, such as `127.0.0.1:6060`, rather than all interfaces. - Use a dedicated `http.ServeMux` and explicitly register only the diagnostic handlers that are required. - Place the endpoint behind authenticated administrative access, a service mesh policy, VPN, SSH tunnel, or equivalent network control. - Do not publish the profiling port through container, Kubernetes Service, ingress, or public firewall configuration. - Apply timeouts and rate limits to reduce resource-exhaustion risk. - Ensure production deployment checks detect publicly reachable debug and profiling endpoints.