T09 · Insecure Skill Coding Practices
Warning
- Location
avatar-generator.js:198- Finding
Unrestricted Remote Download and Arbitrary File Write
- Content
View full analysis
{ const file = fs.createWriteStream(outputPath); https.get(videoUrl, (response) => { response.pipe(file); file.on('finish', () => { file.close(); resolve(outputPath); }); }).on('error', reject); }); } ``` ### Technical Analysis The exported `downloadVideo` method accepts `videoUrl` and `outputPath` without validating either value. The supplied URL is passed directly to `https.get()`. A caller that can influence this argument can make the process send HTTPS requests to arbitrary hosts, including potentially accessible internal services. There is no hostname allowlist, IP-address validation, redirect policy, or protection against loopback, private, link-local, and cloud metadata destinations. The supplied output path is passed directly to `fs.createWriteStream()`. No canonicalization or containment check restricts the destination to an intended output directory. An attacker-controlled path can therefore overwrite or create any file writable by the Node.js process. The response is streamed without checking its HTTP status, content type, or size. The request also has no timeout. A remote endpoint could consequently provide an unbounded response, keep the connection open, or cause an error response to be written as though it were a valid video. Partial files are not removed when a request fails. The standard pipeline does not currently invoke this method, so exploitation requires another caller to use the exported method with attacker-influenced arguments. ### Attack Path 1. An application imports `AvatarVideoGenerator` and calls `downloadVideo()` using a URL or output filename derived f ...[truncated 1627 chars]- Remediation
View remediation