T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/go4me-lookup.sh:6
- Finding
- Arbitrary HTTPS Request Destination Through Username Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/go4me-lookup.sh:6-18` **Vulnerability Type**: Improper input validation and URL authority injection **Risk Level**: Medium ### Vulnerable Code ```bash go4me_lookup() { local username="${1#@}" # Strip @ if present if [[ -z "$username" ]]; then echo '{"error":"Username required"}' >&2 return 1 fi local url="https://${username}.go4.me/" local response local http_code # Fetch page and capture HTTP code response=$(curl -s -w "\n%{http_code}" "$url" 2>/dev/null) ``` ### Technical Analysis The function removes one leading `@` but does not validate that the remaining input conforms to the permitted Twitter-handle syntax. It embeds the untrusted value directly into the authority portion of an HTTPS URL. Characters that have special meaning in a URL authority—particularly `@`—can change how `curl` interprets the hostname. For example, the input: ```text ignored@attacker.example/path ``` produces: ```text https://ignored@attacker.example/path.go4.me/ ``` In URL syntax, `ignored` is interpreted as user information and `attacker.example` becomes the destination host. The suffix `/path.go4.me/` is interpreted as the request path rather than as part of the hostname. Quoting `"$url"` prevents shell word splitting but does not prevent semantic URL injection. TLS certificate verification remains enabled and provides some protection, but an attacker controlling a domain with a valid certificate can still receive the request. ### Attack Path 1. An attacker supplies a crafted lookup value containing an authority delimiter, such as `ignored@attacker.example/path`. 2. `go4me_lookup` removes only an optional leading `@` and accepts the remainder unchanged. 3. The value is concatenated into `https://${username}.go4.me/`. 4. `curl` parses the injected `@` and treats the attacker-controlled domain as the destination hostname. 5. The skill sends an HTT ...[truncated 859 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Apply strict allowlist validation before constructing the URL. If the intended identifier is a Twitter/X handle, accept only the documented handle character set and length: ```bash go4me_lookup() { local username="${1#@}" if [[ ! "$username" =~ ^[A-Za-z0-9_]{1,15}$ ]]; then printf '%s\n' '{"error":"Invalid username"}' >&2 return 1 fi local url="https://${username}.go4.me/" # Continue with the request. } ``` Additional hardening should include: 1. Reject URL separators, dots, whitespace, additional `@` characters, percent-encoding, and control characters. 2. Configure `curl` with explicit failure and timeout behavior, such as `--fail-with-body`, `--connect-timeout`, and `--max-time`. 3. Restrict redirects or validate every redirect destination before following it. The current command does not follow redirects, and that property should not be changed without validation. 4. If more flexible identifiers are later required, construct and parse the URL using a URL-aware library and verify that the final hostname is exactly a valid single-label subdomain of `go4.me`. ]]>