T05 · Unauthorized Access and Privilege Escalation
Error
- Location
workflow.py:114- Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
tuple[str, dict]: try: parsed_url = urlparse(url) domain = parsed_url.netloc.lower() fetch_site_config = config.get('fetch_site', {}) for site_key, site_config in fetch_site_config.items(): if site_key == 'proxy' or site_key == 'general': continue site_domain = site_config.get('domain', '').lower() if site_domain and site_domain in domain: return site_key, site_config if 'general' in fetch_site_config: return 'general', fetch_site_config['general'] except Exception: pass return 'unknown', {} ``` ```python def is_valid_url(url: str) -> bool: """Simple validation that the URL is valid.""" try: p = urlparse(url) return p.scheme in ('http', 'https') and bool(p.netloc) except Exception: return False ``` ```python page = await context.new_page() print(f"Visiting target page: {url}") response: Optional[Response] = await page.goto( url, timeout=60000, wait_until='domcontentloaded' ) ``` ### Technical Analysis The URL validation only verifies that the scheme is HTTP or HTTPS and that a network location exists. It does not resolve or classify the destination address. Consequently, loopback, private, link-local, reserved, and cloud metadata addresses are accepted. Any URL that does not match a configured site is automatically sent to the general scraper. That scraper uses Chromium to navigate directly to the supplied URL, executes the returned page, extracts its text and images, and saves a screenshot. The implementation also does not revalidate the destination after DNS resolution or HTTP ...[truncated 1536 chars]- Remediation
View remediation