T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/audit.sh:6- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
" exit 1 fi echo "=== SEO AUDIT: $URL ===" echo "" # Fetch main page echo "--- MAIN PAGE ---" HTTP_CODE=$(curl -s -o /tmp/seo_page.html -w "%{http_code}" -L "$URL" 2>/dev/null) ``` Additional requests are constructed from the same unvalidated input: ```bash echo "--- ROBOTS.TXT ---" ROBOTS_CODE=$(curl -s -o /tmp/seo_robots.txt -w "%{http_code}" "$URL/robots.txt" 2>/dev/null) echo "--- SITEMAP.XML ---" SITEMAP_CODE=$(curl -s -o /tmp/seo_sitemap.xml -w "%{http_code}" "$URL/sitemap.xml" 2>/dev/null) ``` ### Technical Analysis The script accepts an arbitrary URL as its first argument and passes it directly to `curl`. It does not enforce an `http` or `https` scheme, validate the destination hostname, resolve and inspect destination IP addresses, or reject loopback, private, link-local, reserved, and cloud metadata addresses. The main-page request also uses `curl -L`, which follows redirects. Even if an initial public hostname were trusted, that hostname could redirect the request to an internal address. The destination of each redirect is not revalidated. The downloaded main-page response is parsed and selected values are printed. All fetched responses are also saved to predictable files under `/tmp`. Therefore, the issue can be used for internal network probing and potentially for accessing services that trust requests originating from the host running the skill. ### Attack Path 1. An attacker supplies a URL pointing to an internal service, loopback interface, link-local service, or an attacker-controlled public endpoint. 2. The script passes that URL directly to `curl`. 3. Alternatively, the public endpoint returns a redirect to an internal destination ...[truncated 1212 chars]- Remediation
View remediation