T05 · Unauthorized Access and Privilege Escalation
Error
- Location
app/core/security.py:43- Finding
Unrestricted Server-Side Request Forgery in the URL Fetch Endpoint
- Content
View full analysis
bool: """ Validate URL format. - Must start with http:// or https:// """ if not url: return False return url.startswith(("http://", "https://")) ``` ```python # app/routers/proxy.py:75-84 from app.core.security import validate_url if not validate_url(fetch_request.url): return JSONResponse( status_code=400, content={ "success": False, "error": "Invalid URL", "message": "URL must start with http:// or https://" } ) ``` ```python # app/managers/proxy_manager.py:221-240 proxy_url = f"http://127.0.0.1:{self.clash_mixed_port}" transport = httpx.AsyncHTTPTransport(proxy=proxy_url) async with httpx.AsyncClient( timeout=30.0, follow_redirects=True, transport=transport ) as client: request_headers = headers or {} request_headers.setdefault("User-Agent", "ProxyGateway/0.3.0") response = await client.request( method=method.upper(), url=url, headers=request_headers, content=body ) ``` ### Technical Analysis The URL validation only verifies that the supplied string begins with `http://` or `https://`. It does not parse and validate the destination hostname, resolve DNS addresses, restrict destination ports, or reject loopback, private, link-local, reserved, multicast, and cloud metadata addresses. The forwarding implementation accepts a caller-controlled method, URL, headers, and body. It also enables automatic redirects without validating each redirect destination. Consequently, an external caller can instruct the server to make requests to resources reachable from the serve ...[truncated 1860 chars]- Remediation
View remediation