T09 · Insecure Skill Coding Practices
- Location
main.py:12- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 12–16; attacker-controlled input originates at lines 50–51
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: HighVulnerable Code
python def scrape_web(url): """抓取网页""" try: import requests response = requests.get(url, timeout=10)The request URL is taken directly from command-line input:
python action = sys.argv[1] url = sys.argv[2] if action == "scrape": result = scrape_web(url)Technical Analysis
The application passes a user-controlled URL directly to
requests.get()without validating the scheme, hostname, destination IP address, port, or redirect chain. Consequently, a user who can invoke the skill can cause its execution environment to send requests to destinations that may not be reachable from the user's own network.Potential targets include loopback services, private-network hosts, link-local addresses, and cloud instance metadata endpoints. Because Python Requests follows redirects by default, validation of only an initial URL would also be insufficient: an external URL could redirect the request to an internal destination.
The response body is not returned in full. However, the generated report records the HTTP status code, response length, and any matched HTML title. These values can act as an oracle for internal service discovery and may disclose limited response-derived information.
Attack Path
- An attacker with permission to invoke the skill supplies a URL targeting a loopback, private, link-local, or otherwise internal address.
main()reads the value fromsys.argv[2]without validation.scrape_web()passes the value directly torequests.get().- The process sends the request using the host environment's network access and trust boundaries.
- The generated Markdown report exposes the response status, content length, and potentially the page title.
- The attacker repeats reques ...[truncated 941 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict accepted schemes to
httpandhttps; reject all other schemes and malformed URLs. - Prefer an explicit allowlist of approved destination domains rather than accepting arbitrary hosts.
- Resolve the hostname before connecting and reject every address classified as loopback, private, link-local, reserved, multicast, or unspecified for both IPv4 and IPv6.
- Protect against DNS rebinding by ensuring that the validated address is the address actually used for the connection.
- Disable automatic redirects where they are unnecessary. If redirects are required, validate the scheme, hostname, port, and resolved addresses of every redirect target before following it.
- Reject URLs containing embedded credentials and restrict destination ports to those required for legitimate operation.
- Apply outbound firewall or proxy rules that prevent the process from reaching internal networks and cloud metadata services.
- Set response-size limits in addition to the existing timeout to reduce resource-exhaustion risk.
- Return a clear validation error without making a network request when a destination violates policy.
- Add tests covering loopback, private IPv4, private IPv6, link-local and metadata addresses, encoded IP representations, DNS rebinding scenarios, and redirects to prohibited destinations.
- Restrict accepted schemes to