T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:35- Finding
Unrestricted Product URLs May Enable Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:35-49;scripts/manage.py:45-56
Vulnerability Type: Unrestricted URL handling and potential server-side request forgery
Risk Level: MediumVulnerable Code
SKILL.md:35-49:markdown The agent should: - Accept any e-commerce product URL - Ask for the desired check frequency (default: 24h) - Ask for an optional target/alert price - Store the config in `scripts/prices.json` ### Step 2: Price Scanning When the user asks to scan or on schedule, the agent: 1. Reads the product list from `scripts/prices.json` 2. For each URL: - Visits the page using web browser - Extracts: product name, current price, currency, stock status, seller namescripts/manage.py:45-56:python url = args[0] if args else input("URL: ") name = input("Product name (optional): ").strip() interval = input("Check interval in hours (default 24): ").strip() or "24" alert_price = input("Alert price (optional): ").strip() pid = products["next_id"] products["next_id"] += 1 entry = { "id": pid, "url": url, "name": name or f"Product #{pid}",Technical Analysis
The Skill explicitly accepts any URL and stores it without validating its scheme, hostname, resolved address, port, or redirect destination. The scanning workflow subsequently instructs an agent-controlled browser to visit every stored URL.
Consequently, an attacker who can add a tracking target may supply a URL pointing to a loopback service, RFC1918 private network, link-local address, cloud metadata service, or another endpoint reachable from the agent environment but not from the attacker. Scheduling increases the exposure because the request may be repeated automatically across sessions.
The actual network request is performed by the agent/browser rather than the included Python scripts. Exploitability therefore depends on the browser tool's network isolation ...[truncated 1430 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the instruction to accept any URL with an explicit allowlist of supported public e-commerce domains.
- Permit only
httpsURLs and reject URLs containing embedded credentials, unsupported ports, or ambiguous hostname encodings. - Resolve the hostname before every request and reject loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 ranges.
- Explicitly block cloud metadata addresses, including
169.254.169.254, and equivalent provider-specific hostnames. - Revalidate every redirect destination and enforce a low redirect limit.
- Defend against DNS rebinding by binding requests to the validated public address or repeating address validation at connection time.
- Run browser requests in an isolated environment without access to the host network or cloud metadata service.
- Require confirmation when a URL is outside the supported marketplace-domain allowlist.
- Validate all existing targets before creating a recurring scan task, and disable scheduled scans containing invalid targets.
- Avoid recording arbitrary response bodies or internal endpoint content in reports, history, or notifications.