T03 · Remote Payload Retrieval and Execution
Error
- Location
assets/anduoduo_risk_report.html:7- Finding
Mandatory HTML Report Retrieves and Executes Unverified Remote JavaScript
- Content
View full analysis
``` The report template is mandatory for overview reports according to `SKILL.md:121-128`, so this remote script is loaded whenever a generated report is opened with network access. ### Technical Analysis The HTML report executes Chart.js directly from jsDelivr at viewing time. The script element does not specify a Subresource Integrity hash, and the report has no Content Security Policy restricting script execution or outbound connections. This creates a mutable remote execution channel: the effective JavaScript executed by the report is determined by an external CDN response after the Skill package has been reviewed. A compromised CDN, package distribution path, publisher account, or network trust component could supply malicious JavaScript. Because the script runs in the report's page context, it can inspect all rendered DOM content. The report may contain cloud account names, asset identifiers, regions, risk descriptions, rule details, and remediation recommendations. ### Attack Path 1. The Skill queries the authenticated Anduoduo API and generates a cloud-risk HTML report. 2. The recipient opens the report in a browser while network access is available. 3. The browser requests `chart.umd.min.js` from `cdn.jsdelivr.net`. 4. An attacker who has compromised the relevant CDN or package delivery path returns modified JavaScript. 5. The browser executes the substituted code in the report context. 6. The malicious code reads report content from the DOM. 7. The code may transmit that information to an attacker-controlled endpoint or alter the displayed findings. ### Impact Assessment Successful exploitation permits arbitrary JavaScript executio ...[truncated 375 chars]- Remediation
View remediation