T09 · Insecure Skill Coding Practices
Error
- Location
get.py:601- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: r = requests.get(url, headers={"User-Agent": DEFAULT_UA}, timeout=timeout) r.raise_for_status() ``` ```python if args.url: u = args.url.strip() path = urlparse(u).path.strip("/").split("/") slug = path[0] if path and path[0] else "" ``` ### Technical Analysis The `--url` option accepts an arbitrary URL and passes it directly to `requests.get()`. The code parses the URL path to obtain a slug but does not validate the scheme, hostname, port, resolved IP address, or redirect destination. Consequently, the documented option can be used to send requests to destinations other than the intended `fangjia.fang.com` service. Depending on the execution environment, reachable targets may include: - Loopback services such as `127.0.0.1` - Private-network services - Link-local cloud metadata endpoints - Internal administrative interfaces - Services exposed through HTTP redirects A timeout limits request duration but does not prevent unauthorized network access. The use of `raise_for_status()` also does not mitigate SSRF because the request has already reached the target. ### Attack Path 1. An attacker supplies a request that causes the Agent to invoke the Skill with a crafted `--url` value. 2. The value identifies an internal destination, such as a loopback service, private address, or metadata endpoint. 3. The URL is assigned to `u` without validation. 4. `fetch_html(u)` passes the value directly to `requests.get()`. 5. The Skill connects to a destination reachable from the Agent's network context. 6. Response content may be partially exposed through title, heading, price-block, or error-derived output, while timing and status behavior may also permit internal service discovery. ### Impact Assessment ...[truncated 580 chars]- Remediation
View remediation