T09 · Insecure Skill Coding Practices
- Location
SKILL.md:73- Finding
Unvalidated Template Variables Used as Email Link Destinations
- Content
View full analysis
{{ctaLabel | default:"Open"}}Sent by {{brandName}}. {{#if unsubscribeUrl}}Unsubscribe.{{/if}} ``` ### Technical Analysis The template places `ctaUrl` and `unsubscribeUrl` directly into HTML `href` attributes. Although the documented template engine HTML-escapes interpolated values, HTML escaping does not validate the URI scheme, hostname, or destination. If an attacker can influence either variable, they can supply an attacker-controlled phishing or tracking URL. Depending on the receiving email client's behavior, an unsafe scheme such as `javascript:` might also be retained or activated. Email-client filtering is inconsistent and should not be treated as the primary security boundary. ### Attack Path 1. An attacker gains control over, or supplies data for, `ctaUrl` or `unsubscribeUrl`. 2. The application passes the value to the email template without URL validation. 3. The template engine escapes HTML metacharacters but preserves the selected URI scheme and destination. 4. The generated email contains a link to the attacker-controlled destination. 5. A recipient activates the link and is redirected to a phishing, tracking, or otherwise malicious resource. 6. Any further compromise depends on recipient interaction and the behavior of the destination or email client. ### Impact Assessment This issue does not directly grant operating-system, application, or Drin account privileges. Its scope is the generated email and its recipients. Succes ...[truncated 389 chars]
- Remediation
View remediation