T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/perform_voice_feature_extraction.py:37- Finding
Arbitrary URL Fetch Enables SSRF and Sensitive Content Relay
- Content
View full analysis
str: if not url.startswith(("http://", "https://")): raise VoiceFeatureConfigError("--file-url must be an http(s) URL") return url ``` ```python def download_file(file_url: str, timeout: int) -> tuple[str, str, bytes]: status, headers, content = request_http("GET", file_url, timeout=timeout) if status < 200 or status >= 300: raise RuntimeError(f"Failed to download file URL: HTTP {status}") parsed = parse.urlparse(file_url) filename = PurePosixPath(parsed.path).name or "audio.bin" content_type = headers.get("Content-Type") or mimetypes.guess_type(filename)[0] return filename, content_type or "application/octet-stream", content ``` ```python file_url = ensure_file_url(args.file_url) filename, content_type, file_content = download_file(file_url, timeout=args.timeout) boundary, body = build_multipart_body( prompt=args.prompt, model=args.model, filename=filename, file_content_type=content_type, file_content=file_content, ) _, headers, raw_response = request_http( "POST", API_URL, headers={ "Authorization": f"Bearer {api_key}", "X-Failover-Enabled": args.failover_enabled, "Content-Type": f"multipart/form-data; boundary={boundary}", }, body=body, timeout=args.timeout, ) ``` ### Technical Analysis The script accepts a user-controlled `--file-url` and validates only that its literal value starts with `http://` or `https://`. It does not validate the destination hostname or resolved IP address. Consequently, the process can be instructed to issue HTTP GET requests to: - Loopback addresses such as `127.0.0.1` or `::1` - RFC 1918 private network ranges - ...[truncated 2719 chars]- Remediation
View remediation