T09 · Insecure Skill Coding Practices
- Location
main.py:12- Finding
Unrestricted User-Controlled URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 12–16; the URL enters from command-line input at lines 49–53
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: HighVulnerable Code:
python def scrape_web(url): """抓取网页""" try: import requests response = requests.get(url, timeout=10)User-Controlled Input Flow:
python action = sys.argv[1] url = sys.argv[2] if action == "scrape": result = scrape_web(url)Technical Analysis
The application accepts an arbitrary URL from
sys.argv[2]and passes it directly torequests.get. It does not validate the URL scheme, hostname, resolved IP address, destination port, or redirect targets.An attacker who can invoke the skill can therefore cause the runtime host to send requests to destinations that may not be directly accessible to the attacker, including:
- Loopback services such as
127.0.0.1or::1 - Private network services
- Link-local addresses and cloud instance metadata endpoints
- Internal administrative interfaces
- Attacker-controlled URLs that redirect to restricted destinations
Because
requests.getfollows redirects by default, validating only the initial hostname would not be sufficient. DNS resolution must also be checked to prevent hostnames from resolving to prohibited address ranges.The implementation does not return the complete response body. However, it writes response-derived information to a report, including the status code, content length, HTML title, and number of links. This permits internal-service discovery and limited information disclosure.
Attack Path
- The attacker invokes the skill with the
scrapeaction and supplies a loopback, private-network, link-local, metadata, or redirecting URL. main()reads the attacker-controlled value fromsys.argv[2].main()passes that value toscrape_web()without valida ...[truncated 1122 chars]
- Loopback services such as
- Remediation
View remediation
Remediation Suggestions
- Permit only explicitly required schemes, normally
httpsand, if necessary,http. - Prefer an explicit allowlist of trusted hostnames rather than accepting arbitrary Internet destinations.
- Resolve the hostname before connecting and reject every resolved loopback, private, link-local, multicast, unspecified, and reserved IPv4 or IPv6 address.
- Block known cloud metadata destinations and other environment-specific sensitive endpoints.
- Disable automatic redirects with
allow_redirects=False, or validate the scheme, hostname, port, and resolved IP address at every redirect hop. - Prevent DNS rebinding by ensuring the validated address is the address used for the connection.
- Restrict destination ports to those required for the feature.
- Apply outbound firewall or proxy rules so application-level validation is not the only protection.
- Stream responses with strict connection, read, and total-size limits to reduce resource-exhaustion risk.
- Return generic errors and avoid exposing internal destination details to untrusted callers.
- Add automated tests covering loopback, private IPv4 and IPv6 ranges, link-local addresses, metadata endpoints, encoded IP representations, redirects, and DNS rebinding scenarios.
- Permit only explicitly required schemes, normally