T05 · Unauthorized Access and Privilege Escalation
Error
- Location
clip-note.mjs:396- Finding
Unrestricted Image Fetching Enables Server-Side Request Forgery and Data Exfiltration
- Content
View full analysis
img.getAttribute('src')) .filter(src => src && !src.startsWith('data:')) .map(src => { try { return new URL(src, document.baseURI).href; } catch(e) { return null; } }) .filter(Boolean); return { title: r.title || document.title, content: r.content, source: r.source, imageUrls: [...new Set(imageUrls)] }; ``` The collected URL is then fetched directly with automatic redirect following: ```js async function downloadImage(url, referer, destPath) { try { return await fetchImageViaFetch(url, referer, 10_000, destPath); } catch (e) { // Trigger DNS fallback on timeout. if (e.name === 'AbortError' || (e.message && e.message.includes('timeout'))) { debug(`DNS fallback triggered — url: ${url}, reason: ${e.message}`); return await fetchImageWithDnsFallback(url, referer, destPath); } throw e; } } async function fetchImageViaFetch(url, referer, timeoutMs, destPath) { const res = await fetch(url, { headers: { 'Referer': referer, 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36', }, signal: AbortSignal.timeout(timeoutMs), redirect: 'follow', }); if (!res.ok) throw new Error(`HTTP ${res.status}`); const contentType = res.headers.get('content-type')?.split(';')[0]?.trim() || ''; ``` The fallback performs public DNS resolution and connects directly to the resulting IP, but do ...[truncated 5128 chars]- Remediation
View remediation