T09 · Insecure Skill Coding Practices
- Location
imgforge.py:42- Finding
Unvalidated API-Provided Image URL Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
imgforge.py, lines 42–44, 67, and 116–117
Vulnerability Type: Server-side request forgery and unbounded remote response handling
Risk Level: MediumVulnerable Code
python def _fetch_bytes(url: str) -> bytes: with urllib.request.urlopen(url, timeout=120) as r: return r.read()The URL originates from the remote task response and is used without validation:
python if st == "SUCCEED": return data["output_images"][0]python url = _await_task(token, tid) _save(_fetch_bytes(url), dest)Technical Analysis
The application trusts
output_images[0]returned by the ModelScope API and passes it directly tourllib.request.urlopen. It does not:- Require the
httpsscheme. - Restrict downloads to documented ModelScope or image-CDN hostnames.
- validate redirect destinations.
- Reject loopback, link-local, private, reserved, or cloud-metadata IP addresses.
- Validate that the response content type is an image.
- Limit the number of bytes read into memory.
If the API, an upstream component, or the task response is compromised, an attacker-controlled URL can cause the Agent host to issue requests to otherwise inaccessible local or internal resources. Depending on supported URL handlers and runtime configuration, the URL may also reference an unintended local or non-HTTP resource.
Reading the complete response with
r.read()without a size limit additionally creates a denial-of-service risk from an excessively large or non-terminating response. The resulting bytes are then written to a user-selected local path without confirming that they represent an image.Attack Path
- A user invokes the Skill to generate an image.
- The Skill authenticates to the declared ModelScope service and creates an asynchronous generation task.
- A compromised or malicious upstream response returns an attacker-controlle ...[truncated 1360 chars]
- Require the
- Remediation
View remediation
Remediation Suggestions
- Parse the returned URL and accept only the
httpsscheme. - Maintain an explicit allowlist of documented ModelScope image-delivery hostnames. Reject user-information components, unexpected ports, malformed hosts, and all other domains.
- Disable automatic redirects or validate every redirect target using the same scheme, hostname, port, and address checks.
- Resolve the hostname and reject loopback, private, link-local, multicast, reserved, unspecified, and cloud-metadata destinations for both IPv4 and IPv6. Mitigate DNS rebinding by connecting only to the validated resolved address while preserving correct TLS hostname verification.
- Require an expected image media type and validate the downloaded bytes with an image decoder before saving them.
- Stream the response in bounded chunks rather than calling unrestricted
read(). Enforce a conservative maximum file size and abort whenContent-Lengthor streamed bytes exceed it. - Apply separate connection and read timeouts and limit redirect count.
- Prefer a documented API mechanism that returns image bytes directly or signed URLs restricted to a known trusted CDN.
- Save downloaded data to a temporary file first and atomically move it to the destination only after all checks succeed.
- Parse the returned URL and accept only the