T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/geocode.sh:22
- Finding
- Unrestricted geocoding endpoint override enables server-side request forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/geocode.sh:22-24, 28-33, 51, 103-116` **Vulnerability Type**: Server-Side Request Forgery through an unvalidated configurable endpoint **Risk Level**: Medium ### Vulnerable Code ```bash curl_json() { curl -fsSL "$@" printf '\n' } curl_hint() { local response response="$( curl -sSL \ -A "$user_agent" \ -w $'\n%{http_code}' \ "${base_url%/}/" )" local http_code="${response##*$'\n'}" local body="${response%$'\n'*}" ``` ```bash base_url="${GEOCODE_BASE_URL:-https://geocode.com.cn}" ``` ```bash args=( --get "${base_url%/}/" -A "$user_agent" --data "lat=$latitude" --data "lon=$longitude" ) if [[ "$lang" != "" ]]; then args+=(--data-urlencode "accept-language=$lang") fi curl_json "${args[@]}" ``` ### Technical Analysis The `GEOCODE_BASE_URL` environment variable is used directly as a curl destination without validating its scheme, hostname, port, resolved IP address, or URL components. Both the `hint` and `reverse` commands consequently permit requests to an arbitrary destination selected through the environment. The curl calls also use `-L`, which follows HTTP redirects. Therefore, even if the initial address appears acceptable, an attacker-controlled server can redirect the request to loopback, private, link-local, or other internally reachable addresses. No validation is performed on redirect destinations. The script returns the fetched response through standard output. The `hint` command may also print an unexpected response body to standard error. This creates a response-capable SSRF condition rather than merely a blind network probe. Exploitation requires the attacker to control `GEOCODE_BASE_URL` or a deployment configuration that supplies it. The documented support for endpoint overrides increases the likelihood that external orchestration or agent-controlled execution could expose this configuration surface. ### Attack Path 1. The attack ...[truncated 1942 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict supported schemes** - Parse the configured URL and permit only `https`. - Reject URLs containing embedded credentials, fragments, or unexpected ports. - Configure curl with `--proto '=https'` and `--proto-redir '=https'`. 2. **Enforce an endpoint allowlist** - In production, allow only the documented `geocode.com.cn` hostname. - If self-hosted providers are required, accept an explicit administrator-managed allowlist rather than an unrestricted URL. - Keep arbitrary endpoint overrides limited to isolated test environments. 3. **Block internal destinations** - Resolve the hostname before making the request. - Reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. - Account for all DNS answers and DNS rebinding instead of validating only the textual hostname. 4. **Harden redirect behavior** - Prefer disabling redirects by removing `-L`. - If redirects are functionally required, limit their number and validate every redirect target against the same scheme, hostname, port, and resolved-address policy. - Do not assume validating only the initial URL is sufficient. 5. **Reduce response exposure** - Do not print arbitrary provider error bodies to standard error. - Apply response size and timeout limits, such as `--max-time`, `--connect-timeout`, and `--max-filesize` where supported. - Validate that successful responses have the expected JSON structure and content type before returning them. 6. **Separate testing configuration** - Require an explicit test-mode flag before honoring a custom endpoint. - Ensure production launchers clear or securely define `GEOCODE_BASE_URL`. - Prevent untrusted users or agent-generated input from setting process environment variables. ]]>