T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- handler.py:6
- Finding
- Unrestricted URL Fetching Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `handler.py`, lines 6-11 **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High ### Vulnerable Code ```python if "http" in input_text: try: url = re.search(r'https?://[^\s]+', input_text).group(0) text = requests.get(url, timeout=10).text except: return {"error": "Could not fetch URL"} ``` ### Technical Analysis The handler extracts an arbitrary HTTP or HTTPS URL from attacker-controlled input and requests it from the server environment. It does not validate the destination hostname, resolved IP address, port, URL credentials, or network range. The `requests.get` call follows redirects by default. Consequently, even an initially acceptable-looking URL could redirect to a loopback, link-local, private, reserved, or cloud metadata address. The timeout only limits request duration and does not prevent SSRF. Although the response is filtered through an email-address regular expression before being returned, the request itself can still reach internal services. The response also creates a limited disclosure channel when internal content contains email-like strings. Requests may additionally trigger state-changing behavior if an internal endpoint improperly accepts GET requests. ### Attack Path 1. An attacker submits input containing a URL controlled by the attacker or pointing directly to an internal destination. 2. The regular expression extracts that URL without applying destination restrictions. 3. The application sends the request from its own network and privilege context. 4. The target may be a loopback service, private-network host, link-local metadata endpoint, or attacker-controlled redirect. 5. Any email-like values in the response are extracted and returned to the attacker. 6. Even without a matching response value, the outbound request can be used for internal service discovery or to invoke reachable GET endpoints. ### Impact Assessment ...[truncated 526 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Prefer an explicit allowlist of trusted domains and permitted ports. - Accept only canonical `http` and `https` URLs parsed by a dedicated URL parser. - Reject URLs containing embedded credentials or malformed hostnames. - Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, unspecified, and cloud metadata address ranges for both IPv4 and IPv6. - Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection. - Disable redirects, or validate the destination of every redirect before following it. - Restrict outbound network access at the firewall or container level so the process cannot contact internal networks or metadata services. - Apply maximum response-size and content-type limits before loading response bodies into memory. - Use separate connection and read timeouts. - Avoid broad exception handling; catch expected request and parsing exceptions explicitly and log failures without exposing sensitive details. ]]>