T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/image_handler.py:24- Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
tuple: """ Download an image from URL. Returns (local_path, error). """ os.makedirs(f"{WORKSPACE}/images", exist_ok=True) filename = f"{WORKSPACE}/images/img_{os.getpid()}.jpg" try: req = urllib.request.Request( url, headers={ "User-Agent": "Mozilla/5.0 (compatible; DontWasteFoodBot/1.0)" } ) with urllib.request.urlopen(req, timeout=timeout) as response: data = response.read() content_type = response.headers.get("Content-Type", "image/jpeg") ext = ".jpg" if "jpeg" in content_type or "jpg" in content_type else ".png" filename = filename.replace(".jpg", ext) with open(filename, "wb") as f: f.write(data) size = os.path.getsize(filename) if size < 500: os.remove(filename) return None, "File too small — not a valid image" return filename, None ``` ```python if is_url(source): return download_image(source) ``` ### Technical Analysis The image handler accepts a user-controlled HTTP or HTTPS URL and passes it directly to `urllib.request.urlopen`. It does not restrict destination hosts, resolve and inspect destination IP addresses, or reject loopback, private, link-local, reserved, and cloud metadata address ranges. Redirects are also not validated. An initially permitted-looking URL can therefore redirect the request to an internal destination. The implementation trusts the remote `Content-Type` header when selecting a file extension and does not verify that the downloaded content is an image. In addition, `response.read()` ...[truncated 1521 chars]- Remediation
View remediation