T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/download.py:18- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
scripts/download.py, lines 18-32
Vulnerability Type: Server-Side Request Forgery through insufficient URL validation
Risk Level: MediumVulnerable Code
python # 提取 note ID note_id_match = re.search(r'xiaohongshu\.com/explore/([a-f0-9]+)', url) if not note_id_match: note_id_match = re.search(r'xiaohongshu\.com/discovery/item/([a-f0-9]+)', url) note_id = note_id_match.group(1) if note_id_match else None try: # 方法1: 使用 API if note_id: api_url = f"https://www.xiaohongshu.com/discovery/item/{note_id}" resp = requests.get(api_url, headers=headers, timeout=30) else: resp = requests.get(url, headers=headers, timeout=30)Technical Analysis
The Skill is declared to process Xiaohongshu URLs, but URLs that do not match the expected Xiaohongshu path patterns are fetched directly. The fallback branch does not validate:
- The URL scheme
- The exact destination hostname
- Embedded credentials or nonstandard ports
- Whether the hostname resolves to a loopback, private, link-local, or reserved address
- Redirect destinations
Python Requests follows redirects by default. Consequently, even an initially permitted destination could redirect the request to an internal service.
The response body is not directly returned to the caller, which limits straightforward data extraction. However, the request still originates from the Agent's network context and can be used for blind internal-service probing. If a fetched response has the expected Xiaohongshu state structure, extracted media URLs may also cause subsequent outbound requests.
Attack Path
- An attacker supplies a URL targeting an internal service, loopback interface, cloud metadata endpoint, or attacker-controlled redirector.
- The Agent invokes
full-analyze.shwith that URL. - The URL does not match either expected Xiaohongshu path expressio ...[truncated 1072 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse input with
urllib.parse.urlsplit()rather than relying on substring-oriented regular expressions. - Require HTTPS and an exact hostname allowlist, such as
www.xiaohongshu.com. - Reject URLs containing embedded credentials, unexpected ports, malformed hostnames, or unsupported paths.
- Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IP ranges for both IPv4 and IPv6.
- Disable redirects with
allow_redirects=False, or validate every redirect target using the same scheme, hostname, port, and resolved-address checks. - Apply destination validation again before downloading an extracted media URL.
- Consider enforcing outbound network policy outside the application so the process cannot contact local, private, or metadata address ranges.
- Call
raise_for_status()and impose response-size limits to reduce abuse and resource-consumption risks.
- Parse input with