T09 · Insecure Skill Coding Practices
- Location
scripts/main.ts:141- Finding
Unrestricted Remote Image Resolution Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.ts, lines 141–148
Vulnerability Type: Server-Side Request Forgery through remote image resolution
Risk Level: MediumVulnerable Code
ts const hasRemoteImages = images.some((image) => image.originalPath.startsWith("http://") || image.originalPath.startsWith("https://"), ); const tempDir = hasRemoteImages ? fs.mkdtempSync(path.join(os.tmpdir(), "markdown-to-html-")) : baseDir; const contentImages = await resolveContentImages(images, baseDir, tempDir, "markdown-to-html");Technical Analysis
Remote image URLs extracted from attacker-controlled Markdown are passed to
resolveContentImageswithout application-level validation of the destination host, resolved IP address, redirect targets, or network range.Checking only whether a value begins with
http://orhttps://does not prevent requests to loopback, link-local, private-network, or cloud metadata addresses. The conversion process may therefore act as a server-side HTTP client with access to network resources unavailable to the attacker.The implementation shown also does not impose explicit response-size, timeout, redirect-count, or content-type restrictions at the call site. The dependency's internal safeguards were not available in the audited project, so the SSRF finding is based on the absence of destination controls before invoking it.
Attack Path
-
An attacker provides a Markdown file to a user or service that invokes this Skill.
-
The Markdown contains an image reference to a sensitive network destination, for example:
markdown Alternatively, the URL may target
127.0.0.1, an RFC 1918 private address, an internal hostname, or a public hostname that redirects to one of those destinations. -
replaceMarkdownImagesWithPlaceholdersextracts the image URL. -
The code recognizes the URL as an HTTP or HTTPS resource.
-
The unvalid ...[truncated 986 chars]
-
- Remediation
View remediation
Remediation Suggestions
- Disable remote image retrieval by default and require an explicit option to enable it.
- Prefer an allowlist of trusted HTTPS origins.
- Parse URLs with the platform URL parser and reject embedded credentials, unsupported schemes, malformed ports, and ambiguous host representations.
- Resolve the hostname before connecting and reject loopback, link-local, private, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
- Repeat destination validation after every DNS resolution and every redirect to prevent DNS rebinding and redirect-based bypasses.
- Block cloud metadata destinations such as
169.254.169.254and platform-specific metadata hostnames. - Apply strict connection, read, and total-operation timeouts.
- Limit redirect count and downloaded response size.
- Validate the response
Content-Typeand accept only required image formats. - Stream downloads with a hard byte limit rather than buffering unrestricted responses.
- Add tests covering loopback, private IPv4, IPv6 loopback, link-local addresses, redirects to private hosts, DNS rebinding behavior, oversized responses, and timeout handling.