T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/crawl.py:69
- Finding
- Unrestricted URL Fetching Enables Server-Side Request Forgery## Vulnerability Details **File Location**: `scripts/crawl.py:69-74`, with attacker-controlled input accepted at `scripts/crawl.py:130-134` and propagated by `scripts/run_pipeline.py:108-109,205-209` **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL fetching **Risk Level**: Medium ### Vulnerable Code ```python response = session.get( url, headers=headers, timeout=timeout, allow_redirects=True ) ``` The URL is accepted without restriction: ```python parser.add_argument( "--url", default=os.getenv("TARGET_URL", DEFAULT_URL), help=f"Target URL (default: {DEFAULT_URL})" ) ``` The pipeline propagates the supplied value to the crawler: ```python crawl_args = [] if url: crawl_args.extend(["--url", url]) returncode, output_file = run_script(CRAWL_SCRIPT, crawl_args) ``` ### Technical Analysis Although the Skill is declared as a crawler for `https://hn.aimaker.dev/`, it accepts an arbitrary URL from either the `--url` argument or the `TARGET_URL` environment variable. It does not validate: - The URL scheme - The destination hostname - The destination port - The IP addresses produced by DNS resolution - Whether the address is loopback, private, link-local, reserved, or a cloud metadata endpoint - Redirect destinations Because `allow_redirects=True` is enabled, an initially acceptable endpoint could redirect the request to an internal service. The returned response body is subsequently written to disk and may be processed by later pipeline stages. This exceeds the minimum network privilege required for a Skill whose stated purpose is limited to crawling `hn.aimaker.dev`. ### Attack Path 1. An attacker or untrusted caller influences the `--url` argument or `TARGET_URL` environment variable. 2. The attacker supplies a loopback, private-network, link-local, metadata-service, or redirecting URL. 3. `requests.Session.get()` s ...[truncated 898 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict destinations to an explicit hostname allowlist, preferably only `hn.aimaker.dev`. 2. Require HTTPS and reject unsupported schemes, embedded credentials, unexpected ports, and malformed URLs. 3. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, unspecified, and metadata-service IP ranges for both IPv4 and IPv6. 4. Disable automatic redirects or validate every redirect destination using the same scheme, hostname, port, and resolved-address policy. 5. Protect against DNS rebinding by verifying the address used for the connection, not only an earlier DNS lookup. 6. Apply an outbound network policy at the container or host level so the process cannot reach internal networks or metadata services. 7. Limit response size and redirect count to reduce denial-of-service exposure. 8. If arbitrary crawling is intentionally supported, require explicit user confirmation and run the network stage in an isolated environment with restricted egress.