T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/check-qq-doc-updates.py:153
- Finding
- Unrestricted URL Fetching Enables SSRF and Local Resource Access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check-qq-doc-updates.py`, lines 153–183 **Vulnerability Type**: Server-Side Request Forgery (SSRF) and unrestricted local resource retrieval **Risk Level**: Medium ### Vulnerable Code ```python name = str(doc.get("name") or f"doc-{idx}") page_url = str(doc.get("url") or "").strip() doc_id = str(doc.get("id") or "").strip() or parse_doc_id(page_url) public_url = strip_query(page_url) if page_url else page_url doc_key = doc_id or public_url or name prefix = f"{idx:02d}_{sanitize_name(name)}" cookie_path = raw_dir / f"{prefix}.cookies.txt" html_path = raw_dir / f"{prefix}.html" opendoc_path = raw_dir / f"{prefix}.opendoc.js" header_path = raw_dir / f"{prefix}.opendoc.headers.txt" errors: list[str] = [] warnings: list[str] = [] if not page_url: return { "name": name, "url": public_url, "doc_key": doc_key, "id": doc_id, "fetch_ok": False, "errors": ["url is empty"], } code, err = run_cmd( [ "curl", "-sSL", "-c", str(cookie_path), "-b", str(cookie_path), "-A", user_agent, page_url, "-o", str(html_path), ], timeout=timeout, ) ``` ### Technical Analysis The configured `page_url` is passed directly to `curl` without validating its scheme, hostname, port, resolved IP address, or redirect destination. The `-L` option instructs curl to follow redirects automatically. Consequently, a configuration entry can direct the process to destinations outside the declared Tencent Docs scope. The Skill only needs to communicate with Tencent Docs, but the implementation can access: - Loopback services such as `127.0.0.1` or `::1` - Private network services - Link-local and cloud metadata endpoints - Unexpected external domains - Non-HTTP resources supported by the installed curl build, potentially including `file://` The response is written to the workspace as ...[truncated 2463 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Enforce the declared destination scope** - Accept only absolute HTTPS URLs. - Normalize the hostname and require an exact match for `docs.qq.com`. - Reject embedded credentials, unexpected ports, malformed URLs, and non-HTTPS schemes. 2. **Control redirects** - Prefer disabling redirects. - If redirects are necessary, inspect and validate every redirect destination before issuing the next request. - Apply the same scheme, hostname, port, and IP-address restrictions to every hop. 3. **Prevent access to internal addresses** - Resolve the hostname before connecting. - Reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 addresses. - Protect against DNS rebinding by ensuring the validated address is the one used for the connection. 4. **Restrict curl protocols** - Add protocol restrictions such as `--proto =https` and `--proto-redir =https`. - Avoid relying only on string-based URL validation. 5. **Limit resource consumption** - Set a maximum response size. - Add connection, total-transfer, and low-speed timeouts. - Reject oversized responses and ensure partial files are removed after failures. 6. **Harden raw-data retention** - Keep raw response and cookie retention disabled by default. - Warn users explicitly that `--keep-raw` may retain sensitive content. - Create retained files with restrictive permissions. - Avoid retaining cookie files unless they are essential for an explicit debugging workflow. 7. **Add security tests** - Test rejection of `file://`, loopback, private-network, link-local, and metadata-service URLs. - Test redirects from an allowed-looking URL to a prohibited destination. - Test IPv6, alternative IP notation, hostname normalization, and DNS rebinding scenarios. ]]>