T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:148
- Finding
- Unrestricted URL Retrieval Enables SSRF and Data Exfiltration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 95-96 and 148-153 **Vulnerability Type**: Server-Side Request Forgery and unintended data disclosure **Risk Level**: High ### Vulnerable Code ```text 2. Public `file_url` (`http://` or `https://`): - download to temp local file, then upload. ``` ```bash FILE_URL="https://example.com/input.jsonl" EXT="${FILE_URL##*.}" FILE_PATH="$(mktemp "/tmp/batchjob-input.XXXXXX.${EXT:-jsonl}")" curl -fL --retry 3 --connect-timeout 10 "$FILE_URL" -o "$FILE_PATH" ``` ### Technical Analysis The Skill instructs the Agent to download any user-provided HTTP or HTTPS URL. Although the source is described as “public,” no technical control enforces that restriction. The `curl` command follows redirects through `-L`, but the Skill does not require validation of either the initial URL or subsequent redirect destinations. It does not reject: - Loopback addresses such as `127.0.0.1` and `::1` - RFC1918 private networks - Link-local addresses - Cloud metadata services - Internal DNS names - Redirects from public hosts to private addresses - Plaintext HTTP sources After retrieval, the normal execution flow treats the downloaded file as an upload source. Consequently, this behavior can combine SSRF with exfiltration: content obtained from an internal service can be transmitted to the configured BatchJob endpoint. URL retrieval is needed for the declared public-file workflow, but unrestricted access to arbitrary network locations exceeds the minimum privilege required to download genuinely public datasets. ### Attack Path 1. An attacker supplies an HTTP or HTTPS URL as the BatchJob input source. 2. The URL directly references an internal resource or redirects to one. 3. The Agent executes `curl -fL` and retrieves the resource from its own network context. 4. The downloaded response is saved as a temporary local file. 5. The file resolver returns that path to the upload workflow. 6. The Agent Base64-encodes t ...[truncated 718 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Accept only `https://` source URLs unless plaintext HTTP is explicitly required and approved. 2. Parse URLs with a dedicated URL parser rather than relying on string-prefix checks. 3. Resolve the hostname before connecting and reject: - Loopback ranges - Private IPv4 and IPv6 ranges - Link-local ranges - Multicast and reserved ranges - Known cloud metadata addresses 4. Validate every redirect target before following it. Do not rely on validation of only the initial URL. 5. Prefer an allowlist of approved dataset-hosting domains. 6. Protect against DNS rebinding by validating resolved addresses and ensuring the connection uses the validated destination. 7. Set strict response-size and download-time limits. 8. Require explicit user confirmation before uploading remotely retrieved content, showing the final resolved source hostname. 9. Keep the download and BatchJob upload as separately authorized operations rather than automatically chaining them. ]]>