T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawdraw.mjs:1964- Finding
DNS Rebinding Bypasses Image Fetch SSRF Protection
- Content
View full analysis
= 16 && parts[1] <= 31) || (parts[0] === 192 && parts[1] === 168) || (parts[0] === 169 && parts[1] === 254) || parts[0] === 0 || address === '::1' || address.startsWith('fe80:') || address.startsWith('fc00:') || address.startsWith('fd'); if (isPrivate) { throw new Error('Private/internal URLs are not allowed.'); } } ``` The validated address is not bound to the subsequent request: ```js const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), 30_000); let res; try { res = await fetch(url, { redirect: 'manual', signal: controller.signal, }); } finally { clearTimeout(timeout); } ``` ### Technical Analysis The code resolves the supplied hostname with `lookup()` and verifies that the returned address is not within selected private, loopback, or link-local ranges. The later `fetch()` call independently resolves the hostname again. This creates a time-of-check/time-of-use discrepancy. An attacker wh ...[truncated 2439 chars]- Remediation
View remediation