T09 · Insecure Skill Coding Practices
Warning
- Location
- server.js:64
- Finding
- Web Service Listens on All Network Interfaces Despite Localhost-Only Documentation<![CDATA[ ## Vulnerability Details **File Location**: `server.js:64-66` **Vulnerability Type**: Unnecessarily exposed network service **Risk Level**: Medium ### Vulnerable Code ```javascript server.listen(PORT, () => { log('info', `Web 服务已启动`, { port: PORT, url: `http://localhost:${PORT}` }); }); ``` ### Technical Analysis No hostname is supplied to `server.listen`. In Node.js, this normally causes the server to listen on the unspecified IPv6 or IPv4 address, exposing it through all available network interfaces rather than only through the loopback interface. This behavior conflicts with the documented access scope of `http://localhost:34567`. The current implementation serves static files and does not contain authenticated or state-changing endpoints, which limits the immediate impact. Nevertheless, hosts on the same network—or remote systems when firewall or port-forwarding rules permit it—can reach the service. ### Attack Path 1. A user activates the Skill, starting the HTTP server on port `34567`. 2. Node.js binds the listener to all available network interfaces. 3. An attacker scans the user's reachable address and discovers port `34567`. 4. The attacker connects directly to the service without authentication. 5. The attacker retrieves the hosted content and can repeatedly send requests to the exposed HTTP listener. ### Impact Assessment An unauthenticated network attacker can access the Skill's web service wherever host and network firewall rules allow connectivity. The exposed content is currently static and does not include identified secrets, so no direct privilege escalation or confidential-data compromise was established. The principal impacts are unintended service exposure, expanded attack surface, content enumeration, and potential resource consumption through repeated requests. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Bind the service explicitly to the loopback interface: ```javascript server.listen(PORT, '127.0.0.1', () => { log('info', 'Web service started', { port: PORT, url: `http://127.0.0.1:${PORT}` }); }); ``` Additional hardening should include: 1. Validate that the configured port is an integer in the range `1-65535`. 2. Add request timeouts and conservative header limits. 3. Return `405 Method Not Allowed` for methods other than `GET` and `HEAD`. 4. Add security headers, including `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, and `Referrer-Policy`. 5. If non-local access is intentionally required in the future, make it an explicit configuration option and add authentication. ]]>