T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate_image.py:250
- Finding
- Unvalidated Provider-Controlled URL Enables SSRF and Arbitrary Resource Retrieval## Vulnerability Details **File Location**: `scripts/generate_image.py`, lines 250–259 **Vulnerability Type**: Server-Side Request Forgery (SSRF) and unrestricted URL scheme handling **Risk Level**: Medium **Vulnerable Code**: ```python image_url = result["results"][0]["url"] content = result["results"][0].get("content", "") if content: print(f"Model response: {content}") print("Downloading image...") try: with urllib.request.urlopen(image_url, timeout=60 * 2) as resp: output_path.write_bytes(resp.read()) except Exception as e: ``` ### Technical Analysis The image URL returned by the remote generation provider is passed directly to `urllib.request.urlopen()` without validation. The code does not restrict the URL scheme, allowlist trusted CDN hostnames, reject private or reserved IP addresses, validate redirect destinations, limit response size, or verify that the response is an image. Because `urlopen()` supports multiple URL schemes and automatically follows HTTP redirects, a compromised or malicious API response could direct the process to: - Loopback services such as `127.0.0.1`. - Private network services accessible from the host. - Link-local cloud metadata endpoints. - Unexpected local or remote resources supported by the URL handler. - An initially trusted URL that redirects to a prohibited destination. The provider-controlled response body is then written to the user-selected output path without content validation. Although the retrieved content is not subsequently transmitted elsewhere by this script, the behavior creates an SSRF primitive and may expose local or internal content in the output file. ### Attack Path 1. A user invokes the Skill to generate or edit an image. 2. The script submits the prompt and optional input image to `grsaiapi.com`. 3. The provider account, API infrastructure, or returned task data is compromised or manipulated. 4. The task result supplies ...[truncated 1058 chars]
- Remediation
- ## Remediation Suggestions - Accept only `https` result URLs. - Maintain an explicit allowlist of expected image CDN hostnames. - Resolve the destination hostname and reject loopback, private, link-local, multicast, unspecified, and reserved addresses for both IPv4 and IPv6. - Disable automatic redirects or validate the scheme, hostname, port, and resolved addresses of every redirect destination. - Enforce a maximum response size using both `Content-Length` and bounded streaming reads. - Require an expected image `Content-Type`. - Decode and validate the downloaded file as a supported image before committing it to the final output path. - Download to a securely created temporary file and atomically rename it after successful validation. - Consider having the trusted API return image bytes through an authenticated endpoint rather than accepting arbitrary result URLs.