T09 · Insecure Skill Coding Practices
- Location
main.py:11- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 11–15 and 48–52
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: HighVulnerable Code
python def scrape_web(url): """抓取网页""" try: import requests response = requests.get(url, timeout=10)The untrusted URL reaches the vulnerable function through the command-line interface:
python action = sys.argv[1] url = sys.argv[2] if action == "scrape": result = scrape_web(url)Technical Analysis
The application accepts a user-controlled URL and passes it directly to
requests.get()without validating the scheme, hostname, resolved IP address, port, or redirect destination.This creates an SSRF condition because the request originates from the environment running the skill and therefore uses that environment's network reachability. An attacker can target loopback addresses, RFC1918 private networks, link-local services, or cloud metadata endpoints. Moreover,
requests.get()follows redirects by default, so validating only the initial URL would not be sufficient.Although the complete response body is not written to the report, the application exposes response-derived information, including the HTTP status code, content length, page title, and number of matched links. These values can act as an oracle for internal service discovery and limited data extraction.
Attack Path
- An attacker invokes the skill with the
scrapeaction and supplies an internal or otherwise protected URL. main()assigns the untrusted argument tourlwithout validation.scrape_web()passes the URL directly torequests.get().- The process connects to the destination using its own network privileges.
- The application processes the response and writes its status, length, title, and link count to a Markdown report.
- The attacker reads the generated report or console-provided report path to infer whether the internal service exists and ...[truncated 1097 chars]
- An attacker invokes the skill with the
- Remediation
View remediation
Remediation Suggestions
- Restrict accepted schemes to
httpandhttps; reject credentials, malformed hosts, and unsupported URL forms. - Prefer an explicit allowlist of approved domains and ports when the intended use permits it.
- Resolve the hostname before connecting and reject every resolved address belonging to loopback, private, link-local, multicast, unspecified, reserved, or other non-public ranges for both IPv4 and IPv6.
- Explicitly block cloud metadata destinations and environment-specific internal service names.
- Disable automatic redirects unless required. If redirects are enabled, validate every redirect target using the same scheme, hostname, port, DNS, and IP checks.
- Protect against DNS rebinding by ensuring the validated address is the address used for the connection, or enforce destination restrictions through a controlled outbound proxy.
- Apply network-level egress filtering so the process cannot connect to internal networks or metadata services.
- Allow only approved destination ports and set strict connection and read timeouts.
- Stream responses and enforce a maximum response size to prevent resource exhaustion.
- Return a clear validation error without exposing unnecessary internal connection details.
- Add tests covering loopback, RFC1918, link-local, IPv6 local addresses, alternate IP encodings, malicious redirects, and DNS rebinding scenarios.
- Restrict accepted schemes to