T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/playwright-stealth.js:47
- Finding
- Unrestricted Browser Navigation with Chromium Security Isolation Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/playwright-stealth.js:47-52, 88-92`; `scripts/playwright-simple.js:31` **Vulnerability Type**: Server-side request forgery exposure and weakened browser containment **Risk Level**: High ### Vulnerable Code ```javascript // scripts/playwright-stealth.js:47-52 const browser = await chromium.launch({ headless: headless, args: [ '--no-sandbox', '--disable-setuid-sandbox', '--disable-blink-features=AutomationControlled', '--disable-features=IsolateOrigins,site-per-process', ], }); ``` ```javascript // scripts/playwright-stealth.js:88-92 const response = await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000, }); ``` ```javascript // scripts/playwright-simple.js:31 await page.goto(url, { waitUntil: 'domcontentloaded' }); ``` ### Technical Analysis Both scraper implementations accept a URL directly from command-line input and navigate to it without validating the protocol, hostname, resolved IP address, or redirect destination. There is no restriction against loopback, link-local, private-network, or cloud metadata endpoints. Arbitrary public HTTP and HTTPS targets are necessary for a general-purpose scraper, but access to internal network resources is not required for that functionality. The stealth implementation further starts Chromium with its sandbox and site/process isolation disabled. Anti-automation behavior does not require disabling these principal security boundaries. This creates two related risks: 1. The scraper can act as an SSRF-capable browser from the network context of the host. 2. A malicious page is processed by a browser with materially reduced containment. Host compromise would still generally require a compatible browser vulnerability, but these flags increase the consequences of such an exploit. ### Attack Path 1. An attacker convinces a user or Agent workflow to scrape an attacker-selected URL. 2. The attac ...[truncated 1194 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Allow only `http:` and `https:` URLs and reject URLs containing embedded credentials. 2. Resolve target hostnames before navigation and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. 3. Intercept browser requests and repeat destination validation for every redirect and subresource request to prevent redirect-based and DNS-rebinding bypasses. 4. Introduce an explicit hostname allowlist where the deployment has a known set of permitted targets. 5. Remove `--no-sandbox`, `--disable-setuid-sandbox`, and `--disable-features=IsolateOrigins,site-per-process`. 6. Run Chromium as a dedicated unprivileged user in an OS-level container with a read-only filesystem, restricted outbound networking, no host-network access, and no mounted credentials. 7. Apply navigation, response-size, and total execution limits to reduce denial-of-service exposure. ]]>