T09 · Insecure Skill Coding Practices
Error
- Location
- index.js:128
- Finding
- Unrestricted Fetch of a Server-Controlled Image URL<![CDATA[ ## Vulnerability Details **File Location**: `index.js:128-133` **Vulnerability Type**: Server-Side Request Forgery and Unbounded Response Buffering **Risk Level**: High ### Vulnerable Code ```js const data = await response.json(); const imageUrl = data.imageUrl; // Download image const imageResponse = await fetch(imageUrl); const imageBuffer = await imageResponse.arrayBuffer(); ``` ### Technical Analysis The image-generation service fully controls `data.imageUrl`. The Skill fetches that URL without validating its protocol, hostname, resolved IP address, redirect chain, response status, content type, or response size. If the external API is malicious or compromised, it can direct the Skill to request loopback addresses, private network services, link-local cloud metadata endpoints, or other resources reachable from the OpenClaw host. Redirects may also be used to bypass a superficial hostname check unless every redirect target is validated. The entire response is then loaded into memory with `arrayBuffer()` without a size limit. An attacker-controlled endpoint can return an extremely large or indefinitely streamed response, causing excessive memory consumption or process instability. ### Attack Path 1. An attacker compromises or controls the configured image-generation API. 2. A user invokes the Skill with avatar generation enabled, which is the default behavior. 3. The API returns an `imageUrl` targeting an internal resource, metadata endpoint, loopback service, or oversized payload. 4. The Skill requests the attacker-selected URL from the OpenClaw host. 5. The request may reach resources unavailable to the attacker directly. 6. The response is buffered without a limit, potentially exposing internal response behavior or exhausting process memory. ### Impact Assessment A successful exploit may provide the attacker with indirect access to services reachable from the OpenClaw runtime, including local or private-network endpoints. Depending on ...[truncated 414 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Permit only `https:` URLs from an explicit allowlist of trusted image hosts. 2. Resolve the destination hostname and reject loopback, private, link-local, multicast, and reserved IP ranges. 3. Disable redirects or validate the protocol, hostname, and resolved address at every redirect hop. 4. Verify `imageResponse.ok` before reading the body. 5. Require an expected image MIME type such as `image/png` or `image/jpeg`. 6. Enforce a strict response-size limit using `Content-Length` where available and a bounded streaming reader regardless of that header. 7. Add an `AbortController` timeout to both image requests. 8. Prefer receiving image bytes directly from the already trusted API response rather than following a second server-selected URL. ]]>