T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/go4me-lookup.sh:6- Finding
Arbitrary HTTPS Request Destination Through Username Injection
- Content
View full analysis
&2 return 1 fi local url="https://${username}.go4.me/" local response local http_code # Fetch page and capture HTTP code response=$(curl -s -w "\n%{http_code}" "$url" 2>/dev/null) ``` ### Technical Analysis The function removes one leading `@` but does not validate that the remaining input conforms to the permitted Twitter-handle syntax. It embeds the untrusted value directly into the authority portion of an HTTPS URL. Characters that have special meaning in a URL authority—particularly `@`—can change how `curl` interprets the hostname. For example, the input: ```text ignored@attacker.example/path ``` produces: ```text https://ignored@attacker.example/path.go4.me/ ``` In URL syntax, `ignored` is interpreted as user information and `attacker.example` becomes the destination host. The suffix `/path.go4.me/` is interpreted as the request path rather than as part of the hostname. Quoting `"$url"` prevents shell word splitting but does not prevent semantic URL injection. TLS certificate verification remains enabled and provides some protection, but an attacker controlling a domain with a valid certificate can still receive the request. ### Attack Path 1. An attacker supplies a crafted lookup value containing an authority delimiter, such as `ignored@attacker.example/path`. 2. `go4me_lookup` removes only an optional leading `@` and accepts the remainder unchanged. 3. The value is concatenated into `https://${username}.go4.me/`. 4. `curl` parses the injected `@` and treats the attacker-controlled domain as the destination hostname. 5. The skill sends an HTT ...[truncated 859 chars]- Remediation
View remediation
&2 return 1 fi local url="https://${username}.go4.me/" # Continue with the request. } ``` Additional hardening should include: 1. Reject URL separators, dots, whitespace, additional `@` characters, percent-encoding, and control characters. 2. Configure `curl` with explicit failure and timeout behavior, such as `--fail-with-body`, `--connect-timeout`, and `--max-time`. 3. Restrict redirects or validate every redirect destination before following it. The current command does not follow redirects, and that property should not be changed without validation. 4. If more flexible identifiers are later required, construct and parse the URL using a URL-aware library and verify that the final hostname is exactly a valid single-label subdomain of `go4.me`. ]]>