T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/check.sh:7- Finding
Unrestricted URL Checking Enables Server-Side Request Forgery
- Content
View full analysis
}" CURL_OUTPUT=$(curl --silent --show-error --max-time 10 \ --write-out "%{http_code}|%{time_total}" \ --output /dev/null \ "$URL" 2>&1) ``` ### Technical Analysis The script accepts an arbitrary URL and passes it directly to `curl` without validating the URL scheme, hostname, resolved IP address, destination port, or network range. An attacker who can influence the URL submitted to this Skill can cause the host running the Skill to initiate requests to destinations reachable from its network context. Potential destinations include: - Loopback services such as `127.0.0.1` and `::1` - Private RFC1918 networks - Link-local addresses - Cloud instance metadata endpoints such as `169.254.169.254` - Internal administrative or monitoring services - Non-HTTP protocols supported by the installed version of `curl` The response body is discarded, which limits direct data extraction. However, the returned HTTP status, request success, error state, and timing still provide a blind SSRF and internal service-discovery channel. Some reachable services may also perform state-changing actions in response to a request. ### Attack Path 1. An attacker causes the Agent or another caller to invoke `check.sh` with an attacker-selected URL. 2. The attacker supplies an internal destination, such as a loopback address, private-network host, or cloud metadata endpoint. 3. `curl` connects to that destination using the network privileges of the machine running the Skill. 4. The script exposes success, failure, status code, and timing information through its output and status log. 5. The attacker repeats requests against different hosts or ports to infer internal network topology and service availability. 6. If a reachable endpoint performs an action thr ...[truncated 683 chars]- Remediation
View remediation