T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/data-fetch.js:58- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
{ const urlObj = new URL(url); const lib = urlObj.protocol === 'https:' ? https : http; const reqOptions = { hostname: urlObj.hostname, port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80), path: urlObj.pathname + urlObj.search, method: options.method || 'GET', headers: { 'User-Agent': 'DataMaster-Pro/1.0', ...options.headers } }; const req = lib.request(reqOptions, (res) => { ``` ```js async function fetchAPI(url, method, headers) { console.log(`📡 正在请求 API: ${url}`); try { const response = await httpRequest(url, { method, headers }); const data = JSON.parse(response); console.log(`✅ 成功获取 ${Array.isArray(data) ? data.length : 1} 条数据`); return data; } catch (error) { console.error(`❌ API 请求失败: ${error.message}`); throw error; } } async function fetchWeb(url, selector) { console.log(`🌐 正在抓取网页: ${url}`); try { const html = await httpRequest(url); ``` ```js if (options.url) { data = await fetchWeb(options.url, options.selector); } else if (options.api) { data = await fetchAPI(options.api, options.method, options.headers); } ``` ### Technical Analysis The command-line `--url` and `--api` values are passed directly to Node.js HTTP clients. The implementation does not: - Restrict requests to approved destinations. - Require HTTPS. - Reject loopback, private, link-local, multicast, or reserved IP ranges. - Block cloud instance metadata addresses. - Resolve and validate hostnames before connecting. - Protect against DNS rebinding. - Apply connection, response, or body-size limits. Network retrieval is necessary for the declared data-f ...[truncated 1440 chars]- Remediation
View remediation