T09 · Insecure Skill Coding Practices
- Location
scripts/indexnow.sh:242- Finding
Unrestricted Remote Sitemap Retrieval Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
scripts/indexnow.sh, lines 242–253
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: Mediumbash cmd_submit_sitemap_url() { local sitemap_url="$1" if [ -z "$sitemap_url" ]; then log_error "请提供 sitemap URL" echo "用法: $0 submit-sitemap-url https://example.com/sitemap.xml" exit 1 fi load_key log_step "下载 sitemap: $sitemap_url" local content content=$(curl -sL "$sitemap_url")Technical Analysis
The
submit-sitemap-urlcommand passes a user-controlled URL directly tocurl. Redirect following is enabled through-L, but the script does not validate the initial URL, redirect destinations, URL scheme, resolved IP address, port, or destination network range.Depending on the protocols supported by the installed
curlbuild, the input may reference non-HTTP schemes in addition to HTTP or HTTPS. For HTTP-based requests, an attacker can target loopback addresses, private network services, link-local addresses, cloud instance metadata endpoints, or a public server that redirects to such a destination.After retrieval, the response is parsed for
<loc>elements and the resulting values are submitted to the external IndexNow API. Consequently, data returned by an internal endpoint could be included in an outbound request if it has content matching the expected sitemap syntax. Even when no matching elements are present, the unrestricted request itself can be used to probe the reachability and response behavior of internal services.Attack Path
- An attacker or untrusted user supplies a crafted argument to
submit-sitemap-url. - The argument references an internal address, loopback service, metadata endpoint, unsupported non-public scheme, or an attacker-controlled public URL that redirects to one.
- The script invokes
curl -sLand follows redirects without checking th ...[truncated 1026 chars]
- An attacker or untrusted user supplies a crafted argument to
- Remediation
View remediation
Remediation Suggestions
- Parse the input using a URL parser and permit only explicitly required schemes, preferably
https. - Reject URLs containing embedded credentials, ambiguous host syntax, fragments, or unnecessary nonstandard ports.
- Resolve the hostname before connecting and reject every address in loopback, private, link-local, multicast, unspecified, reserved, and cloud-metadata ranges for both IPv4 and IPv6.
- Disable automatic redirects or validate every redirect destination using the same scheme, hostname, port, DNS, and IP-range controls. Apply a small redirect limit.
- Mitigate DNS rebinding by ensuring that the address validated is the address used for the connection, such as through controlled DNS resolution and curl address pinning.
- Configure connection and total-operation timeouts, a maximum response size, and an appropriate content-type policy.
- Validate that the downloaded document is a sitemap and that extracted URLs use HTTP or HTTPS and belong to the expected public site host.
- Run the retrieval process with restricted outbound network access so it cannot connect to internal networks or metadata services.
- Avoid forwarding parsed values to IndexNow until each value has passed strict URL and host validation.
- Parse the input using a URL parser and permit only explicitly required schemes, preferably