T09 · Insecure Skill Coding Practices
Warning
- Location
openapi.json:29- Finding
Unrestricted Proxy Target May Enable Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
openapi.json:29-47; supporting documentation atSKILL.md:90-101
Vulnerability Type: Server-Side Request Forgery (SSRF) / unrestricted proxy destination
Risk Level: MediumThe
/viewendpoint accepts a user-controlled URL for an external page without documenting or enforcing any scheme, hostname, IP-address, port, or redirect restrictions.Complete relevant OpenAPI segment:
json "/view": { "get": { "summary": "View Wrapped", "description": "Proxy that wraps external pages with Glancify", "operationId": "view_wrapped_view_get", "parameters": [ { "name": "url", "in": "query", "required": true, "schema": { "type": "string", "title": "Url" } } ],Supporting Skill documentation:
markdown ## GET /view **Summary:** View Wrapped **Description:** Proxy endpoint that wraps an external web page with Glancify, enabling interactive content visualization and analysis. **Parameters:** | Name | Type | Required | Description | |------|------|----------|-------------| | `url` | string | Yes | The full URL of the external webpage to wrap with Glancify | **Response:** - **200 OK** – Successfully wrapped the page; returns wrapped content with Glancify integration - **422 Unprocessable Entity** – Invalid or missing URL parameterTechnical Analysis
The declared purpose of
/viewis to retrieve or wrap an external resource selected through theurlquery parameter. The OpenAPI schema validates this value only as a generic string. Neither the specification nor the Skill documentation defines:- An allowlist of permitted destinations
- Restrictions to safe schemes such as HTTPS
- Rejection of loopback, private, link-local, reserved, or multicast addresses
- Protection against DNS rebinding
- Validation of every redirect desti ...[truncated 2399 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse the supplied value with a standards-compliant URL parser and reject malformed or ambiguous URLs.
- Permit only
httpsunless another scheme is explicitly required; rejectfile,ftp,gopher,data, and all other unsupported schemes. - Prefer an explicit allowlist of approved hostnames and ports instead of allowing arbitrary Internet destinations.
- Resolve the destination before connecting and reject loopback, private, link-local, carrier-grade NAT, multicast, reserved, unspecified, and cloud metadata address ranges for both IPv4 and IPv6.
- Validate the resolved address again when opening the connection to mitigate DNS rebinding and time-of-check/time-of-use issues.
- Disable redirects or apply the complete scheme, hostname, port, DNS, and IP validation process to every redirect hop. Impose a small redirect limit.
- Route outbound requests through an egress proxy or firewall that independently blocks internal and metadata networks.
- Do not forward caller-controlled authorization headers, cookies, or internal service credentials to fetched destinations.
- Apply authentication, per-user authorization, rate limits, request timeouts, response-size limits, and concurrency limits.
- Return generic errors that do not expose internal connection details, and monitor rejected destinations and unusual scanning patterns.
- Update the OpenAPI schema and
SKILL.mdto document all target restrictions and privacy implications. - Add automated tests covering loopback addresses, IPv6 forms, integer and encoded IP representations, private networks, metadata endpoints, redirects, and DNS-rebinding scenarios.