T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_token.py:54- Finding
Unrestricted Custom API Gateway Permits SSRF-Like Outbound Requests
- Content
View full analysis
requests.Response: """Make HTTP request with timeout.""" return requests.get( url, timeout=REQUEST_TIMEOUT, headers={"User-Agent": "AntiRugCN/3.1", "Accept": "application/json"}, ) ``` ```python def fetch(self, chain_id: str, contract_address: str) -> Optional[Dict]: """Fetch token data with retry logic.""" addr_lower = contract_address.lower() for i, base in enumerate(self.endpoints): url = f"{base}/api/v1/token_security/{chain_id}?contract_addresses={contract_address}" try: logger.info(f"[GoPlus] Trying endpoint [{i+1}/{len(self.endpoints)}]: {base}") resp = self._make_request(url) ``` ```python parser.add_argument("--api_gateway", default="", help="Custom API gateway (optional)") ``` ### Technical Analysis The `--api_gateway` value is used as the base of an outbound HTTP request without validating its scheme, hostname, resolved IP address, port, or trust level. A caller can consequently direct the Skill to an arbitrary network destination reachable from the execution environment. Although the request path is fixed to `/api/v1/token_security/...`, the behavior can still be used to probe internal HTTP services or reach endpoints unavailable from the attacker's own network. Plain HTTP gateways are also accepted, allowing queried chain identifiers and public contract addresses to be transmitted without transport encryption. The `requests.get()` call follows redirects by defa ...[truncated 2017 chars]- Remediation
View remediation