T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/check_day.py:11
- Finding
- Caller-Controlled API Endpoint Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check_day.py:11-15`, `scripts/check_day.py:49-50`, and `scripts/check_day.py:62` **Vulnerability Type**: Server-Side Request Forgery (SSRF) through an unrestricted URL **Risk Level**: Medium ### Vulnerable Code ```python def query_isdayoff(date_str, endpoint=DEFAULT_ENDPOINT): # endpoint should be base URL ending with '/' url = endpoint.rstrip('/') + '/' + date_str with urllib.request.urlopen(url, timeout=10) as r: text = r.read().decode('utf-8') # Response is typically a single digit: 0=workday, 1=dayoff, etc. return text.strip() ``` The endpoint is obtained directly from a command-line argument and passed to the vulnerable function: ```python p.add_argument('--endpoint', help='Альтернативный endpoint API', default=DEFAULT_ENDPOINT) ``` ```python resp = query_isdayoff(date_str, endpoint=args.endpoint) ``` ### Technical Analysis The `--endpoint` argument gives the caller full control over the base URL passed to `urllib.request.urlopen`. The application does not validate the URL scheme, hostname, destination port, resolved IP address, or redirect destination. Consequently, a caller can direct the script to make requests to loopback interfaces, private network addresses, link-local services, or other resources reachable from the host. Redirects may also allow an initially permitted-looking destination to forward the request to an internal service. The script appends `/YYYYMMDD` to the supplied endpoint, which constrains the requested path but does not prevent network reconnaissance or access to internal HTTP services that respond to arbitrary paths. If the response is not recognized as an expected numeric API result, it is printed by the following code at lines 67-68: ```python if kind is None: print('UNKNOWN API RESPONSE:', raw) sys.exit(4) ``` This creates a response-disclosure channel for reachable services. ### Attack Path 1. An attacker or untrusted ...[truncated 1580 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--endpoint` option if alternate API servers are not required. Use the fixed HTTPS endpoint declared by the skill. 2. If endpoint customization is necessary, enforce an explicit allowlist of trusted hostnames. 3. Permit only the `https` scheme and reject URLs containing user information, fragments, unsupported ports, or ambiguous host representations. 4. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, and unspecified IP addresses for both IPv4 and IPv6. 5. Disable automatic redirects or validate the scheme, hostname, port, and resolved destination of every redirect. 6. Protect against DNS rebinding by ensuring the validated address is the address used for the connection. 7. Set a strict maximum response size instead of reading an unlimited body. 8. Avoid printing raw responses from untrusted or internal endpoints. Log only a bounded, sanitized diagnostic message. 9. Add automated tests covering loopback addresses, private ranges, IPv6 literals, alternate schemes, encoded hostnames, unusual ports, and redirects to prohibited destinations. ]]>