T09 · Insecure Skill Coding Practices
Error
- Location
bing-search.js:151- Finding
Server-Side Request Forgery Through Arbitrary URL Fetching
- Content
View full analysis
{ const client = url.startsWith('https') ? https : http; const req = client.get(url, { ``` The URL is obtained directly from command-line input: ```js } else if (command === 'fetch') { const url = args[1]; const result = await crawlWebpage(url); ``` ### Technical Analysis The `fetch` operation accepts an attacker-controlled URL and passes it directly to Node.js `http.get()` or `https.get()`. It does not parse and validate the destination hostname, resolved IP addresses, destination port, or URL protocol against a security policy. The existing `isBlacklisted()` check only searches the raw URL for a small set of public website domain substrings. It does not block sensitive destinations such as: - IPv4 and IPv6 loopback addresses - Private network address ranges - Link-local addresses - Cloud instance metadata services - Internal DNS names - Services listening on nonstandard ports The network request executes with the network access available to the Node.js process. Consequently, the function can reach services that may not be directly accessible to the party controlling the input. ### Attack Path 1. An attacker causes the Skill to invoke the `fetch` command with a URL targeting an internal resource, such as a loopback service, private-network host, or cloud metadata endpoint. 2. The URL does not contain one of the public domains in `BLACKLIST`, so `isBlacklisted()` returns `false`. 3. `crawlWebpage()` passes the URL directly to `http.get()` or `https.get()`. 4. The Node.js process connects to the internal destination using its own network privileges. 5. The response is converted ...[truncated 1000 chars]- Remediation
View remediation